OpenDManaged
Sign in See our docs Get started

Security

Built so the wrong reader never sees the wrong page

Access control is not a layer on top of OpenD; it is the core of how content is compiled and served. Here is exactly what we do, and what we do not claim.

  • Per-reader access

    Every page, search result, PDF and help topic passes through one reader filter.

  • Fail-closed by default

    Unknown values, typos and unparseable ranges hide content instead of showing it.

  • Isolated instances

    One OpenD instance per customer, with its own database, storage and project.

  • Secrets protected

    Instance secrets are encrypted at rest and handed to you once, through a one-time link.

Content access

If OpenD is unsure whether a reader may see something, it hides it.

  • A product or feature the reader’s organisation does not hold hides the content
  • Undeclared values and bad release ranges hide content and fail validation
  • Hidden pages and missing pages return the same 404
  • Links to hidden topics never reveal the target’s title
  • Search only matches, ranks and quotes what the reader can see
  • PDFs are rendered per entitlement set; covers never name an organisation

Tested, not assumed

Leaks are treated as bugs that tests must catch.

  • OpenD’s test suite includes an end-to-end leak test over the starter template
  • Every page and publication of OpenD’s own docs is rendered for each preview reader in CI
  • A push that fails validation never goes live; the previous release stays up
  • Every check runs the same in CI, the CLI, the previewer and the server

Identity and embedding

Readers authenticate with your identity provider; host apps vouch for their users.

  • Reader sign-in through OpenID Connect, matched by verified email
  • Embed tokens are signed by your backend and live at most 10 minutes
  • A token cannot grant more than the reader’s organisation is entitled to
  • Only allow-listed origins may frame the help panel
  • The panel cookie is partitioned, HttpOnly and Secure
  • Entitlement webhooks are signed, time-limited and idempotent

Managed platform

How we run your instance.

  • One isolated instance per customer: web, worker, Postgres and blob storage
  • Instance secrets encrypted with AES-GCM in our control plane
  • Your administrator token is shown once; mail scanners cannot use up the link
  • Strict Content Security Policy, no inline scripts, HTTPS with HSTS
  • Rate limits on every unauthenticated endpoint
  • Payments are handled by Stripe; card details never reach our servers

Privacy

Analytics that help authors without profiling readers.

  • Page views and searches never store a reader’s email, id or IP address
  • Do Not Track and Global Privacy Control are respected
  • Analytics can be turned off entirely
  • Rows are deleted after the retention period

What we do not claim

We do not hold SOC 2 or ISO 27001 certification today, and we do not publish uptime guarantees. If your procurement process needs a questionnaire, a DPA or custom terms, contact us.

Report a vulnerability

Found a security issue in the service or in OpenD? Email the contact address in your welcome email. OpenD is open source, so you can also read the code on GitHub.

Publish docs that fit every reader

Bring your DITA repository. We will have your instance running in minutes.

Get started See our docs