# Our approach to security

- [Terms & Conditions](https://opencagedata.com/terms)
- [Data Protection / Privacy / GDPR](https://opencagedata.com/gdpr)
- [HIPAA](https://opencagedata.com/hipaa)
- [Security](https://opencagedata.com/security-policy)
- [Credits](https://opencagedata.com/credits)

### Introduction

Security and privacy are critical and non-negotiable values of our service.

On this page we address questions potential customers commonly ask us about our approach to security.

If, after reading this document, you still have questions please [get in touch](https://opencagedata.com/contact).

Please note: as a European (German) company we are bound by GDPR, you can find all details of our approach to privacy and data protection on [our GDPR page](https://opencagedata.com/gdpr).

### Context / General background

Our service exists to make open data easily usable. The data our [geocoding API](https://opencagedata.com/api) and [geosearch](https://opencagedata.com/geosearch) services return is all public information. We aggregate and simplify the use of data that is freely available across the internet.

Nevertheless, we take the security of all systems and our users, especially their privacy, very seriously.

We hold no payment information, and always collect as little data as possible.

### Account protection

At sign up or when changing passwords, we show users their password strength. We encourage all users of our services to only use secure passwords (ideally via a password manager).

Whether a paying customer or a free-trial account, users can secure their account with two-factor authentication (2FA). We encourage use of this feature.

The OpenCage account dashboard is only accessible via HTTPS.

Users can [replace their geocoding API key(s) at any time](https://opencagedata.com/guides/how-to-create-a-new-api-key) in their account dashboard.

Users can delete their account at any time, and inactive accounts are automatically deleted after three months.

No user data is ever sold or shared with third parties.

All request logs are deleted after six months. Users can opt for us to have no record whatsoever of their queries via use of the optional `no_record` parameter.

### Payment data

We NEVER hold any customer payment credentials (card numbers, etc).

Payment/Billing is handled via our payment processor, Stripe. All details of Stripe's security practices and PCI compliance can be found on the [Stripe security page](https://stripe.com/help/security).

### Development process and awareness of vulnerabilities

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

### ISO 27001 and other security certifications

As a small business giving away publicly available open data, we do not believe the burden of ISO 27001 or SOC2 certification would be appropriately proportionate.

Our API and geosearch services are hosted at multiple redundant locations within the EU with the well-known hosting company Hetzner, which is ISO 27001 certified. Please see the [full details on the Hetzner site](https://www.hetzner.com/unternehmen/zertifizierung/).

Our team does NOT have physical access to any of our servers.

### Backups / Data Retention / AI / Data Handling Policies

- As a European company we are bound by GDPR. Please see [our GDPR page](https://opencagedata.com/gdpr) where this is explained in detail.
- 

- 

- Request logs are deleted after six months, though users can opt for us to have no record whatsoever of their queries via use of the optional `no_record` parameter - [see relevant documentation](https://opencagedata.com/api#no_record-param).

- 

### Security Bounty Program / Penetration Testing

We welcome and reward outside help to make us aware of any gaps in our security through our [security bounty program](https://opencagedata.com/security-bounty).

### Stay informed

We invite any users of our services to contact us at any time if they have any questions or concerns regarding security (or any other topics).

In addition:

- Changes to our geocoding API are announced via [our public CHANGELOG](https://github.com/OpenCageData/opencagedata-misc-docs/blob/master/CHANGES.md).

- Operational status, as measured by an independent third party, is always available on [our public status page](https://status.opencagedata.com/).

- In the event of any security issues we will provide prompt updates via [our blog](https://blog.opencagedata.com) and [our Mastodon account](https://en.osm.town/@opencage).