Security & Development Policies

Scope and interpretation

These policies cover OpenTeam-owned application code and services involved in Portal, Team workspaces, Gateway-backed execution, APIs, and connected-account workflows. A specific assessment must identify the components and versions it actually covered; a website-only assessment cannot establish coverage of the full platform.

Policy requirements describe what must be done. Evidence status describes what has been verified. An unverified control must not be represented as completed, independently assessed, certified, or approved. Open items remain open until the responsible reviewer checks the supporting records.

What the current records support

Existing records describe security controls and focused internal tests for authorization, account isolation, OAuth handling, secret exclusion, and signed runtime requests. These records support specific development and testing practices within their documented scope.

Builds, formatting, type checks, unit tests, synthetic tests, and dependency checks alone do not establish a complete SAST or DAST assessment. Internal security tests do not establish that an independent third party performed a penetration test. No completed independent assessment or recurring test history is claimed here.

Evidence and disclosure review

• Before any external security attestation, record the applicable policy version, accountable owner, adoption approval, control scope, execution dates, evidence location, and reviewer decision.
• For a scan or assessment, retain the exact application version, environment, method or tool version, coverage and exclusions, findings, remediation decisions, and retest results.
• Keep assessment evidence access-controlled for at least 12 months, unless a longer contractual or legal requirement applies. Minimize personal data and exclude live credentials from reports.
• Review policies and this public status at least annually and after material changes or newly verified assessments. Correct a disclosure when its supporting evidence is no longer accurate or applicable.
• Detailed reports may contain sensitive information. Any sharing requires an access review; evidence requests do not imply that an unverified report exists or is available.

Review references

The external references below inform the evidence categories; they do not certify OpenTeam or establish approval by their publisher. OpenTeam's annual penetration-testing and quarterly scanning cadences are policy requirements defined here.

• Zoom: supporting evidence for security attestations
• Zoom: app security review process
• Zoom: application security recommendations

Questions and evidence requests

Contact [email protected] for security policy questions, evidence requests, or corrections to this disclosure. Do not include passwords, access tokens, or sensitive customer data in an initial message.

Related documents: security overview, Privacy Policy, and Terms of Service.