Security and privacy

Architecture, controls and limitations · Data, retention and sub-processors

Files are fingerprinted locally in the ordinary stamping flow. Account, billing and journal data have separate retention rules. Optional source lookups can send the place you choose; those flows must name the source.

Report an issue to security@openstamps.com.

Availability and incidents

Current probes · Published changes · Availability terms

Historical uptime series: not published. Public incident register: not yet available. Those gaps are not evidence of zero downtime or no incidents. No uptime SLA is promised.

Backup and restoration

The nightly encrypted backup job is configured; its 28 September 2026 invocation was observed. Test fixtures exercise archive restoration and altered-archive refusal.

Production archive restore result: awaiting the owner's completed drill. A job invocation does not demonstrate recoverability. The security notice records the current evidence.

Terms and data processing

Service terms · Business purchasing · Format and checker licences

A DPA draft is prepared for owner/legal review. An executed DPA is not currently supplied by this page; contact the company before relying on one.

Audit roadmap

No ISO 27001 certificate or SOC 2 report is held. Roadmap: finish the restore evidence and control inventory; record access reviews and incident exercises; then seek a scoped independent assessment when revenue supports it. No assessment date or budget is committed.

Open evidence

Frozen specification deposit · Offline checker 1.0.0-rc.1 · Conformance and developer tools

Recompute a reading on your machine. Missing anchors, unsupported formats and unavailable evidence remain explicit gaps.