Security at Open & Run

Last updated October 30, 2026.

Restaurants trust us with sensitive records about their people, including injuries and medical details. Here is how we protect them.

How your data is protected

• Encrypted everywhere. All traffic uses HTTPS, and browsers are told never to connect without it. Data is encrypted at rest with AES-256 by our hosting provider.
• Hosted in the US. Your database, sign-ins and files are hosted in the United States (US East).
• The right people see the right things. Admins, managers and staff see different things. Treatment details, medical answers, medical documents and workers' comp claims are admin-only. Managers see records for their own locations. You choose which documents staff can see.
• Files behind expiring links. Files in your records are never public. Each time someone opens one, the app checks their access and creates a link that expires within an hour (10 minutes for medical files). Food photos for recipes, ingredients and menu items are the exception: they're stored at public addresses that are hard to guess, so don't upload anything sensitive there.
• Checked on the server, every time. Every request is checked against the person's company, role and location before any data is returned. Direct database access from browsers is blocked.
• Records you can trust. Reports are archived, never deleted by mistake. Changes and amendments to a report are saved with who made them. Notes on a report can be edited. Employee statements can't be changed or removed.
• Locked-down sign-in. Passwords are hashed, sessions expire, stolen refresh tokens are detected and revoked, and sign-up, sign-in and password flows are rate limited.
• Location data removed from photos. GPS and other hidden metadata are stripped from uploaded photos.
• Our team. Every team account on our vendors uses two-factor authentication. Access to customer accounts through our internal tools is limited and logged.
• Backups. The database and stored files are backed up daily.
• Tested. We run security scans against the app and fix what they find.

Our vendors

The companies that handle data for us are listed on our Subprocessors page. Our database and storage provider is SOC 2 Type 2 certified.

If something goes wrong

We have a written incident response plan. If a security incident affects your data, we will tell you within 72 hours of confirming it and help you notify anyone you need to.

Report a vulnerability

Found a security issue? Email admin@openandrun.com with "Security" in the subject. Please give us a reasonable chance to fix it before sharing it publicly, and don't access or change other people's data while testing. We will reply within 3 business days.