Security

Fail-open, by construction

The gateway's one non-negotiable property: validation can fail; forwarding cannot. If the validator dies mid-request, if a spec handle is stale, if the violation pipeline stalls, if an allocation fails - the request is forwarded untouched and the violation is dropped. Observing your traffic is our job; carrying it is a duty.

This is tested, not asserted. The chaos harness is a supported switch in the shipping gateway - APIP_CHAOS injects, per request, a dying validator, a freed spec handle, a reporter that blocks forever and an allocation failure, under load. The release gate is zero failed requests with all of it turned on. Ask us for the evidence; showing it is the point of keeping the switch in the product.

What leaves your network

A fingerprint identifies the shape of a violation - operation, schema pointer, error class - so a permanently broken endpoint produces one record, not a million. The single example kept per window has values redacted before it is stored. This sentence appears here, in the DPA, and in the sub-processor list, saying the same thing in all three places.

If that is still more than your security review permits, the data plane runs inside your network as a container, and only the fingerprints described above reach our control plane. That deployment exists precisely for the reviews that end with "traffic does not leave".

Transport, tenancy, retention

• TLS termination

  TLS at our edge, TLS to your upstream. Custom domains get certificates issued and renewed automatically; keys never leave the data plane.

• Tenant isolation

  Proxies are routed by hostname to per-tenant compiled specs. A tenant publishing a new spec version disturbs nobody: in-flight requests finish against the version they started with.

• Secrets are references

  Upstream credentials in configuration are references - { $env: KEY }, { $file: path } - resolved at boot and redacted everywhere they might be printed.

• Retention and deletion

  Drift data lives for your plan's retention window and is deleted on request. Downgrades cap traffic; they do not delete data for 30 days.

• GDPR

  We proxy your traffic, so we are a processor: DPA and sub-processor list available, and data residency is answered up front rather than retrofitted.

• Status, public from day one

  The status page lists the data plane and the control plane as separate components, with the incident history public from the first day - not started once something goes wrong.

The paperwork

The commitments on this page are contractual, not just marketing: the redaction sentence appears in the same words in the data processing addendum, retention and deletion are bound there too, everyone who touches service data is on the public sub-processor list, and the terms and privacy policy carry the rest. We are a processor under UK/EU GDPR for the traffic you proxy; service data is hosted in the UK/EU.

Reporting a vulnerability

Mail security@openapi-proxy.com. We acknowledge within one business day, and we do not consider good-faith research on your own tenant to be a terms violation.