Security at OnSinch
Our customers trust us with data about their staff, clients and finances. This page describes how we protect it and how to report a security issue.
Security leadership
Information security at OnSinch is led by Petr Jaroš, Co-founder, CTO & Head of Security. Petr owns our security program, including vulnerability management, infrastructure security, access control and incident response.
How we test our platform
We follow a written security audit plan and run audits every quarter:
- Dependency audits: every PHP and JavaScript dependency is checked against known vulnerability databases.
- Web application scanning: OWASP ZAP passive scans plus authenticated active scans covering the OWASP Top 10 (injection, cross-site scripting, CSRF, access control). Active scans run only against non-production environments.
- API scanning: our public API is tested for injection and authorization issues.
- Container scanning: our container images are scanned for known vulnerabilities in operating system packages.
- Infrastructure review: twice a year we review our cloud configuration, including access rights, firewall rules and public exposure.
Findings are tracked to closure with fixed remediation targets: critical issues within 7 days, high within 30 days, medium within 90 days.
Infrastructure
- Hosted on Google Cloud Platform in the EU.
- All traffic is encrypted in transit with TLS; data is encrypted at rest.
- Access to production systems is limited to named staff and reviewed at least annually.
Reporting a vulnerability
If you believe you have found a security issue in OnSinch, email security@onsinch.com. Please include enough detail for us to reproduce it.
We will acknowledge your report within 3 business days and keep you updated until it is resolved. We will not take legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before disclosing it.