Security

OpenAttribution is open source infrastructure handling sensitive publisher telemetry. We take that seriously. This page describes how we protect data and how to report vulnerabilities.

Infrastructure

Hosting

• API and telemetry services run on Fly.io in UK regions
• The website and dashboard run on Cloudflare Pages (global edge network)
• Database hosted on Neon (managed PostgreSQL) in AWS eu-west-2 (London, UK)
• All services communicate over TLS. No unencrypted connections.

Architecture

• Three separate services: gateway (auth proxy), identity (accounts and domains), telemetry (event ingestion and querying)
• The gateway validates every request before forwarding to downstream services. Downstream services are not directly exposed to the internet.
• Services are stateless. Session state lives in the database.

Authentication

• Passwordless by default. We use magic links (email) and Google OAuth. No passwords to leak.
• Tokens hashed before storage. Session tokens and API keys are SHA-256 hashed. We cannot read your raw tokens from the database.
• Magic links are single-use. Tokens are deleted immediately after verification. They expire after 15 minutes.
• OAuth uses PKCE. Google OAuth flow uses Proof Key for Code Exchange and state parameters for CSRF protection.
• httpOnly cookies. Session cookies cannot be read by JavaScript. They are Secure (HTTPS only) and SameSite=Lax.
• API keys support revocation and expiry. Keys can be revoked instantly and optionally set to expire on a date.

Data protection

• Encryption in transit. All connections use TLS 1.2+.
• Encryption at rest. Neon encrypts all data at rest using AES-256.
• Organisation isolation. Every API request is scoped to an organisation via the gateway. Downstream services only see data for the authenticated organisation.
• No PII by design. Under the Content Telemetry standard no participant reports the end user's identity, and emitters share only the minimum conversation data the chosen privacy level allows.
• Credential separation. API keys, session tokens, and magic link tokens are stored hashed. Raw values exist only in transit.

Open source

The Content Telemetry standard and its schemas are Apache 2.0 at github.com/SPUR-Coalition/telemetry, and OpenAttribution's SDKs, edge workers, and tools are Apache 2.0 at github.com/openattribution-org. The hosted service is operated under contract on OpenAttribution's behalf; because the protocol is open, anyone can run a competing implementation and verify the wire format.

Open standards are a security feature. More eyes on the format means more scrutiny of what data flows and where.

What we do not do

• We do not run analytics, tracking pixels, or third-party scripts on the website
• We do not store passwords (authentication is passwordless)
• We do not access your Google account beyond basic profile information during OAuth sign-in
• We do not sell, share, or monetise your data

Responsible disclosure

If you find a security vulnerability in OpenAttribution, we would like to hear about it.

How to report

Email security@openattribution.org with a description of the vulnerability, steps to reproduce, and any relevant evidence.

What we commit to

• Acknowledge your report within 48 hours
• Provide an initial assessment within 5 working days
• Keep you informed of our progress
• Credit you publicly (unless you prefer not to be named)
• Not pursue legal action against good-faith security researchers

What we ask

• Do not access or modify other users' data
• Do not disrupt the service (no DoS testing against production)
• Give us reasonable time to fix the issue before public disclosure
• Do not use automated scanners against production without coordination

Incident response

If we discover or are notified of a security incident affecting user data:

• We will investigate immediately and contain the issue
• We will notify affected users within 72 hours as required by UK GDPR
• We will report to the Information Commissioner's Office where required
• We will publish a post-incident report describing what happened, what data was affected, and what we did to prevent recurrence

Contact

Security issues: security@openattribution.org
General privacy questions: privacy@openattribution.org