Security & Compliance
Where OpenBait keeps data, how sign-in works, what the report page collects, where reported URLs go, and who our sub-processors are. Written for vendor reviews.
This page is for the person doing a vendor review. Every statement on it describes something that exists today. We answer infrastructure detail in your security questionnaire, under NDA. What we don't have, such as formal certification, is stated below. If your questionnaire asks for something this page doesn't cover, email contact@openbait.com.
Where data is kept
- Primary data (accounts, brands, reports, cases, evidence) is stored in Japan. Some of it is processed by the sub-processors listed below, which are in the EU and the United States.
- In front of it: Cloudflare provides DNS, CDN, DDoS protection, and TLS termination.
Encryption
- In transit: HTTPS everywhere, TLS 1.2 or higher (TLS 1.3 is negotiated whenever the client supports it). HSTS with a two-year max-age, including subdomains.
- Sessions: encrypted tokens, so tampering is detected.
Sign-in
OpenBait stores no passwords. You sign in with an emailed link, with Google or GitHub, or with a passkey (WebAuthn). There is no password database to leak.
An organization has three roles (owner, admin, and member), and the console API checks the caller's permissions on every route. Changes to brands and to ownership records go into an audit log.
What the report page collects
The public report page (openbait.com/report/your-brand) asks for one thing: the address of the site being reported. A reporter can also add notes and an email address if they want to hear when the site goes offline. Both are optional, and we use the email only for that.
- Reporting needs no account.
- A bot check (Cloudflare Turnstile) runs when a report is submitted. We use the reporter's IP address for that check and for rate limiting, and we don't store it with the report.
- Web server access logs are kept for 180 days.
Where a reported URL is sent
Reporting a site to the parties that can stop it is what the product does, so a reported URL leaves our systems by design.
| Kind of recipient | When | What is sent |
|---|---|---|
| Browser blocklists and threat-intelligence services | Once a site is confirmed as phishing | The URL |
| The hosting provider and the domain registrar | Only after the brand confirms | The URL, the evidence, and the brand being imitated |
| Anti-phishing coordination bodies | Only after the brand confirms | The same |
Which recipients a case goes to, and by which route, is our own operational know-how. We decide it case by case and don't publish it. Once you are a customer, the console shows the recipients of each of your cases.
Reports go out under OpenBait's own fixed reporter identity (contact@openbait.com), marked as made on behalf of the brand. A brand's own domain never appears as the sender. We send nothing to a hosting provider or a registrar without the brand's confirmation.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| XServer Inc. | Production hosting | Japan |
| Cloudflare | DNS, CDN, DDoS protection, bot check (Turnstile), inbound email routing | Global edge |
| Brevo and Postmark | Transactional email | EU / United States |
| Stripe | Billing | United States |
| Sentry | Error monitoring | United States |
| Google (Gemini API) | AI inference for page analysis | United States |
AI processing
Page analysis uses Google's Gemini API. We send the domain name, the name of the brand being checked, a truncated copy of the page's text and HTML, and in some cases a screenshot of the page. Under Google's terms, content sent to the API may be used to improve Google's services, so we send only the suspect page's public content and the brand name. We do not send account details, reporter email addresses, or anything about your other brands. The analysis is one input to a verdict, not the verdict.
Backups
The database is backed up every day. We answer questions on retention and the recovery procedure in the questionnaire.
After the contract ends
When you close your account, we delete your organization's data within 90 days. Copies in backups age out within a further 35 days. Reports we've already sent to registrars and hosting providers can't be recalled. If you need an export, ask before you close the account. Canceling a paid plan doesn't close the account: the workspace moves to the Free plan (see the Subscription & Refund Policy).
How the code is checked
- Every deploy runs dependency vulnerability scans.
- We run internal security reviews regularly and fix their code-level findings in production.
- There is no formal certification (ISO 27001, SOC 2, PrivacyMark). We handle personal data under GDPR and Japan's APPI and will sign a DPA.
If something goes wrong
If an incident affects your organization's data, we notify the organization's owners within 72 hours of detecting it. The notice says what happened, what was affected, and what we have done.
The JavaScript SDK
The SDK is optional. The report page doesn't need it, and most brands never install it.
On your own site, it sends us page information (hostname, URL, title, referrer) and browser information. On events such as a login form being submitted, it also sends a device fingerprint. It never sends what was typed into a field. The privacy policy lists everything it collects.
On your own login page, the fingerprint goes out on every legitimate login too, not only on a clone. If you don't want to make that trade for your customers, leave the SDK off. The report page works without it. The SDK uses no cookies, and none of its data is used for advertising or sold.
Responsible disclosure
We welcome vulnerability reports.
- Address: contact@openbait.com
- Acknowledgment: within 48 hours
- Credit: with your consent, in the release notes once we fix it
Contracts
Email contact@openbait.com for a DPA, an NDA for the evaluation period, or answers to your security questionnaire.
Last updated: September 28, 2026.