# Trust and security

> Where OpenWAF runs, how it protects your configuration, the legal documents (terms, DPA, sub-processors) and how to report a vulnerability.

## Where we run

- Edge nodes in **Germany and Spain**, in the EU.
- DNS servers and customer data in **Germany**. Daily backups go to separate storage in the EU.
- Security events are deleted after 30 days.

The list of companies that process personal data for OpenWAF, with their locations, is on the
[Sub-processors](https://openwaf.dev/legal/subprocessors/) page.

## How the service is protected

- **Signed configuration.** Edge nodes only apply configuration documents signed with Ed25519 and reject anything that
  does not verify. If they cannot reach the control plane, they keep serving the last valid configuration.
- **Change control.** Every change is versioned, needs a reason and is audited. See [Change control](https://developers.openwaf.dev/change-control/).
- **Passwordless sign-in.** Email codes or Google/GitHub; sessions expire. See [Create an account](https://developers.openwaf.dev/fundamentals/create-account/).
- **Tokens.** API tokens are stored only as hashes, with a role, a scope and an expiry of at most 365 days. See
  [API tokens](https://developers.openwaf.dev/fundamentals/api-tokens/).
- **TLS everywhere.** Hybrid post-quantum key exchange is preferred towards visitors and towards origins; new domains
  verify the origin certificate (Full strict). See [SSL/TLS](https://developers.openwaf.dev/ssl/).
- **Hidden DNS primary.** Only the public secondary servers answer DNS queries.

The full, current list of controls and the state of our compliance programme (SOC 2 readiness, ISMS aligned with
ISO/IEC 27001) are on the [Security](https://openwaf.dev/security/) page. Early access has no SLA, no SOC 2 report and
no ISO/IEC 27001 certificate yet.

## Legal documents

| Document | Link |
|---|---|
| Terms of service | [openwaf.dev/legal/terms](https://openwaf.dev/legal/terms/) |
| Acceptable use policy | [openwaf.dev/legal/acceptable-use](https://openwaf.dev/legal/acceptable-use/) |
| Privacy policy | [openwaf.dev/legal/privacy](https://openwaf.dev/legal/privacy/) |
| Data processing agreement (DPA) | [openwaf.dev/legal/dpa](https://openwaf.dev/legal/dpa/) ([PDF](https://openwaf.dev/legal/openwaf-dpa-en.pdf)) |
| Sub-processors | [openwaf.dev/legal/subprocessors](https://openwaf.dev/legal/subprocessors/) |
| Cookies | [openwaf.dev/legal/cookies](https://openwaf.dev/legal/cookies/) |
| Legal notice | [openwaf.dev/legal/notice](https://openwaf.dev/legal/notice/) |

You accept the terms, the acceptable use policy and the DPA when you create your organization. OpenWAF processes your
clients' traffic on your behalf as a processor under the DPA.

## Report a vulnerability

Email [security@openwaf.dev](mailto:security@openwaf.dev), in English or Spanish. The same contact is published in
[security.txt](https://openwaf.dev/.well-known/security.txt). Include a description and its impact, the steps to
reproduce it with the affected host names or URLs, and how we can contact you. Read the
[disclosure guidelines](https://openwaf.dev/security/#disclosure) first: test only what you own or are authorised to
test, and no denial-of-service or heavy scanning.

## Other contacts

| Topic | Contact |
|---|---|
| Support, account help, privacy and DPA questions | [support@openwaf.dev](mailto:support@openwaf.dev) |
| Phishing, malware or other abuse on a site behind OpenWAF | [abuse@openwaf.dev](mailto:abuse@openwaf.dev) |
| Vulnerabilities and security reviews | [security@openwaf.dev](mailto:security@openwaf.dev) |

Automatic emails, such as sign-in codes, come from `noreply@openwaf.dev`, which does not receive replies.