Public evidence
The Personal runtime is open source
The desktop client, Engine, local proxy, mobile client, migrations, and shared contracts are available in the public OpenLeash repository for inspection.
Inspect the source
OpenLeash Trust Center
Evidence before badges.
Clear product boundaries and links your team can verify. OpenLeash does not currently claim SOC 2 or ISO certification.
Current assurance posture
No third-party security certification or audit report is presented as complete here. As independent assurance becomes available, OpenLeash will publish the scope, period, and evidence instead of using an unsupported status badge.
Personal deployment
Local BYOK remains an option
Personal Open Source runs its Engine and Postgres locally and uses a model-provider key supplied by the user. It does not require a OpenLeash Cloud account.
Managed deployment
Business Cloud is hosted
A managed signup creates a free single-member Business organization with evaluation, sync, web access, and administration in OpenLeash Cloud.
Coverage boundary
Protection applies to supported actions
OpenLeash uses agent hooks and supported provider-traffic integrations to observe and evaluate actions. Coverage depends on the agent, installation, configuration, and action path; OpenLeash does not claim to intercept every possible action.
Decision model
Allow, ask, or deny
Supported actions can continue, require a human decision, or be denied by policy. OpenLeash records the result and relevant context for the account or organization view.
Cloud data
Data use is described before purchase
Cloud services process account, device, security-event, approval, and optional provider-usage metadata needed to deliver the product. The Privacy Policy describes the categories and purposes.
Ask the exact questions your deployment needs.
- Which agents, versions, and action paths will employees use?
- Will you run Personal Open Source or a hosted Business Cloud organization?
- Which event context and optional usage metadata will be retained?
- Which protections will monitor, ask, or block for each team?
- Which identity provider or invitation flow will enroll employees?
Start with what exists today.
Agent coverageInstallable protection, guided setup, and detection-only boundaries by agent.Security policyHow to report a vulnerability and what to include.Privacy policyData categories, product uses, sharing, retention, deletion, and user choices.External servicesCurrent hosted, evaluation, billing, identity, analytics, and release dependencies.TermsResponsibilities, account administration, subscriptions, and product limitations.Account deletionThe public process for requesting deletion of a Cloud account.Public releasesRelease artifacts, version history, and published checksums when attached to a release.SupportProduct, privacy, and security contact routes.
Need a focused review?
security@openleash.com Send your architecture or security questions.
We will answer with the current product behavior and available evidence. If something is not implemented or independently verified, we will say so.