Smart Contract Solutions. Inc

Defender has multiple security and data protection controls, including: - Role-based access control (RBAC): Privileged access is provided based on the person’s role, effectively adopting the need-to-know principle. - Multi-factor authentication (MFA): Enhances access control security and prevents system usage via compromised credentials. - Encryption in transit: Your data is secure with state-of-the-art encryption in transit via TLS 1.2 and 1.3. - Encryption at rest: Your data is also protected at rest with AES-256 encryption using Amazon’s Key Management Service (AWS KMS). - Code review and testing: All code changes are peer reviewed. Our Platform goes through rigorous unit and integration testing before releases. - Penetration test: Our Platform is analyzed for vulnerabilities through periodic penetration testing from specialized third-parties. - DDoS protection: Our Platform is protected against decentralized denial-of-service (DDoS) attacks. OpenZeppelin is a cloud-native organization that only utilizes secure partners who are ISO 27001 certified or SOC 2 audited to host our infrastructure and applications.

We enable the community to protect the open economy with our securely designed open source libraries and code through secure patterns and best practices. Our code is trusted by the biggest players in the industry to secure over $50 billion in total value locked. We perform code reviews on all changes, and we maintain a high level of automated test coverage along with use of fuzzing and formal verification. We leverage our Security Research team’s knowledge and expertise for periodic code audits. Every release candidate has a public review period, and ethical hackers are invited to collaborate in the security of our contracts by participating in our Bug Bounty Program through Immunefi. Check our Contracts Security Center for more information about the security or our Contracts library.

At OpenZeppelin, we practice the security controls we recommend to our customers and implement them in our products. That’s why we enforce identity and access management controls across our infrastructure assets and corporate systems, including Single Sign-On (SSO) with multi-factor authentication (MFA), role-based access control (RBAC), strong password policies, and a corporate password manager system, finding the delicate balance between knowledge sharing and the need-to-know principle. We invest heavily in personnel security with actions such as background checks before hiring following local regulations, Security training upon hiring and at least once a year, monthly Security Awareness Newsletters, continuous Phishing program and testing, amongst others. Our Head of Security reviews all suspected or confirmed security-related incidents. We contact affected customers using the most appropriate means. Please email [security@openzeppelin.com](mailto:security@openzeppelin.com) to report suspected security incidents. We analyze our partners’ risks before contracting and periodically thereafter to ensure they maintain the expected robust security posture.

OpenZeppelin operates in accordance with major privacy acts and best practices to ensure your data is safe, protected and in adherence with current law. You own your data and have control over it. Please contact [legal@openzeppelin.com](mailto:legal@openzeppelin.com) if you have any questions about our Privacy Policy, the personal data we hold about you, or if you like to report an ethics or workplace issue.

Reach out about product security or company security please email [security@openzeppelin.com](mailto:security@openzeppelin.com). For questions about contracts, privacy, or to report an ethics or workplace issue please email [legal@openzeppelin.com](mailto:legal@openzeppelin.com). To report a vulnerability in our contracts library please consult our Bug Bounty Program.