OpenGov Trust Center
At OpenGov, we treat the security and reliability of our cloud platform and that of the data it hosts with utmost importance. Building that level of trust with our customers is a key priority for us. Learn about our extensive security and reliability practices and comprehensive compliance controls on this page, or visit security.opengov.com for a deeper architectural overview.
- Contact trust@opengov.com for additional information, compliance documents, or any other concerns related to the assurance of OpenGov’s cloud platform.
- Contact security@opengov.com for reporting vulnerabilities or active security concerns.
Brattleboro
City of Austin
City of San Antonio
Kansas City
City of Hilliard
City of Gahanna
RI
City of Cambridge
City of Los Angeles
City of Orlando
OCFL
City of Phoenix
Self-Assessments
We are working on our security compliance. We can provide completed questionnaires upon request.
Policies
Our policies are currently under review and revision. Please contact us if you would like additional information in the meantime.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Subprocessors
OpenGov Trust Center Updates
Security Update: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
OpenGov is aware of two critical PHP vulnerabilities publicly disclosed on October 21, 2026. Our Security and Engineering teams are actively assessing potential exposure and addressing the vulnerabilities within a limited portion of our environment.
Our response includes:
- Assessing exposure across our environments.
- Implementing initial mitigating controls to reduce exposure.
- Coordinating with customers whose systems are hosted on their own infrastructure to apply protective changes.
- Evaluating and validating additional safeguards.
- Developing and testing longer-term remediation.
- Monitoring for related security activity.
We are prioritizing this work while taking care to maintain the security and stability of our services.
We will continue to update this advisory as our response progresses. Customers with questions can contact security@opengov.com.
Security Advisory: Phishing emails impersonating OpenGov
Update (October 2026): We have also seen emails that impersonate a government customer's procurement staff and mention OpenGov or a real contract number to appear legitimate. These messages ask suppliers to pay a "vendor compliance" or registration fee through a fake payment portal. They often come from a lookalike domain that differs from the agency's real domain by only a few characters.
These messages are not sent by OpenGov. Scammers simply reference our name to make their request look familiar.
OpenGov does not collect fees through email links and will never ask for your password or login credentials by email. If you receive a request like this, do not pay or click. Confirm with a contact you already know, and report it to security@opengov.com and your organization's IT team.
OpenGov is aware that malicious third parties may occasionally impersonate legitimate emails in an attempt to compromise recipients. We have received reports of phishing emails that falsely claim to come from OpenGov or from an "OpenGov Procurement Portal," typically asking the recipient to download a file or follow a link to a third-party website.
This activity originates from outside parties. There is no evidence that OpenGov systems or customer data have been compromised. These messages are not sent by OpenGov and do not come from OpenGov systems.
How to stay safe:
- OpenGov does not send emails that redirect you to third-party file-sharing or websites to retrieve OpenGov documents.
- Do not click links or download files from untrusted or unexpected sources.
- Be cautious of file-share notifications (for example, "you've been sent a file") that reference OpenGov or a procurement portal but come from an unfamiliar sender or domain.
- When in doubt, confirm directly with your trusted OpenGov contact before taking action.
- Report suspected OpenGov-related phishing to security@opengov.com.
- Also report the message to your own organization's IT/security team using your normal process.
We are working with affected customers and will update this notice if our assessment changes.
Cybersecurity Awareness Month: How OpenGov Protects Your Data
October is Cybersecurity Awareness Month. Here is a quick look at how OpenGov keeps your data secure, and where to find the compliance resources your team needs.
Our people
All OpenGov personnel use multi-factor authentication (MFA). Additionally, personnel are required to complete security awareness training and formally acknowledge our security policies annually.
Independent validation
OpenGov completes annual SOC 2 Type 2 examinations, holds TX-RAMP Level 2 and other state RAMP certifications, and mandates annual third-party penetration testing. You can download our SOC 3 report directly from this page - with no NDA required.
Stay alert to phishing
As a reminder, malicious actors occasionally use the OpenGov brand (or impersonate our customers' state and local government portals) as a lure in phishing campaigns. These fraudulent emails typically urge recipients to download a document from a third-party site, or they may impersonate procurement staff to demand a "compliance" fee through a fake payment portal.
OpenGov will never ask for your password or login credentials by email. Please refer to our pinned Security Advisory for full details on how to spot these messages and stay safe. Report anything suspicious to security@opengov.com and your internal IT team.
Need more?
Request access on this page for our SOC 2 report, pen test attestations, and AI governance documentation, or contact trust@opengov.com.