Trust center
What we have in place today, and how your security, risk and audit teams can get the documents they need.
How security worksCertifications and mappings
SOC 2
No reportOpen Token has no SOC 2 report. Our evidence packs index SOC 2 trust services criteria so your auditor can find the relevant evidence.
ISO/IEC 27001
MappingNot certified. Our evidence packs index Annex A controls for your own review.
EU AI Act
MappingOur evidence packs index the record-keeping articles (12, 19 and 26(6)) for your own review.
Mappings help your auditors find evidence; they are not a certification or a compliance claim. Other regulatory mappings, such as BCRA or ISO/IEC 42001, are pending legal review and not offered yet.
Documents for your review
Signed evidence packs
Cryptographically signed packs with access reviews, policy history, audit logs and a control index, on request or delivered every month to your own storage.
Security questionnaires
Answers to your security questionnaire, shared under NDA and reviewed with your team.
Audit log
Policy, budget, access and key changes, with who made them and when, on every plan.
How we protect your data
Metadata by default
Prompts and responses aren't stored unless you opt in. Inference goes only to the provider of the connection you choose.
Least-privilege access
Role-based access, two-factor sign-in that owners can require, and single sign-on, with every change in the audit log.
Edge protection
AWS WAF in front of the site and API, with rate limits; TLS in transit and AWS KMS encryption at rest.
Verifiable evidence
Every evidence pack is signed, so your auditor can check that nothing in it changed.
Need something for a review?
Ask for our questionnaire answers, our latest evidence, or a call with our security team.
See your AI spend the way finance does
Accounts are set up by our team. Tell us which model providers you use and we'll walk you through a live workspace with your own numbers.