Introduction
SafeToOpen Ltd is a New Zealand cybersecurity company (Auckland; D-U-N-S 594990730) providing real-time, zero-day phishing detection for organizations, government agencies, and individuals. This document describes the security architecture, controls, and practices that protect SafeToOpen's services and our customers' data. A companion document, the SafeToOpen Data Handling & Privacy Statement, describes exactly what data our products access, transmit, store, and retain.
Compliance snapshot
| Item | Status |
|---|---|
| ISO/IEC 27001:2022 | Certified — certificate available on our Trust Center (insert certificate number, certification body, and expiry on publication) |
| GDPR | Compliant — see Data Handling & Privacy Statement |
| NZ Privacy Act 2020 / Australian Privacy Principles | Aligned |
| Penetration testing | Performed by an independent third-party security firm; summary letter available under NDA |
| Insurance | Cyber liability insurance held; certificate of currency available on request |
| Data hosting | New Zealand — SiteHost data centres |
Services covered
This document covers the SafeToOpen platform and its delivery channels: the SafeToOpen browser extension (Chrome, Edge, Firefox — "Online Security"), Email Verification (analysis of employee-reported suspicious emails), Customer Email Verification, Brand & Customer Protection (detection of phishing pages impersonating the customer's brand), and the SafeToOpen API.
Architecture overview
SafeToOpen detects previously unseen ("zero-day") phishing pages in real time using two complementary AI analysis engines. X-Ray inspects the underlying code and structure of a page to detect threats invisible to the eye; this structural analysis runs locally in the user's browser. VisionAI analyzes a page the way a person sees it — logos, branding, layout, and login forms — to detect visual impersonation of trusted brands. Together these compress detection from hours or days to seconds, without relying solely on blocklists.
Local-first, minimal cloud submission. Pages are first assessed locally in the browser. Only when a page cannot be cleared locally and requires VisionAI analysis are the page's visual elements and its URL transmitted to the SafeToOpen cloud. Form values, keystrokes, passwords, cookies, and files are never transmitted. The full data model, including what is stored and for how long, is set out in the Data Handling & Privacy Statement.
Hosting and data residency. SafeToOpen cloud services are hosted in New Zealand data centres operated by SiteHost, a New Zealand cloud provider. Customer data submitted for analysis is processed and stored in New Zealand. New Zealand holds a European Commission adequacy decision for personal data transfers, and its data protection regime is familiar to Australian and NZ public-sector reviewers.
Tenant separation. Business customer data is logically separated per customer account, with access controlled as described in §5.
Data security
- Encryption in transit: all communication between the extension, API clients, and SafeToOpen services is encrypted with TLS 1.2 or higher.
- Encryption at rest: stored customer data is encrypted at rest using industry-standard (AES-256) encryption.
- Data minimization: we collect the minimum needed for threat detection; see the Data Handling & Privacy Statement for the per-category table.
- Retention: submitted page data is retained no longer than 30 days unless the page is confirmed malicious, in which case data about the attacker's page is retained as threat intelligence. Customer-reported emails are retained for 90 days.
- Data return & deletion: on termination, customers may request export of their data in a standard format; customer data is deleted within 30 days of termination (backup copies expire within a further 35 days). Confirmation of deletion is available on request.
Access control and personnel security
Access to production systems and customer data follows least-privilege, role-based principles under our ISO 27001 ISMS. Multi-factor authentication is enforced on all production, cloud, and code-repository access. Access rights are reviewed quarterly and revoked within 24 hours of a role change or departure. Administrative access to production is restricted to named individuals and is logged. All personnel and contractors sign confidentiality agreements and complete security awareness training at onboarding and annually.
Secure development
SafeToOpen's browser extensions are distributed exclusively through the official Chrome, Edge, and Firefox stores, each of which independently reviews every release; our Chrome publisher account is verified, follows Google's recommended practices for extensions, and has no history of violations. Internally, changes are version-controlled, code-reviewed before release, and scanned for vulnerable dependencies; development and production environments are separated, and production data is not used in development or testing.
Vulnerability management and testing
- Penetration testing: SafeToOpen engages an independent security firm to test the extension, APIs, and cloud services at least annually. The latest summary letter is available to customers under NDA.
- Scanning & patching: automated dependency and infrastructure vulnerability scanning runs continuously, with remediation targets of 48 hours (critical), 7 days (high), 30 days (medium), and 90 days (low).
- Responsible disclosure: researchers can report vulnerabilities to [email protected] per our Vulnerability Disclosure Policy and
/.well-known/security.txt; reports are acknowledged within 3 business days.
Monitoring, incident response and breach notification
SafeToOpen maintains a documented incident response plan within its ISO 27001 ISMS, covering identification, containment, eradication, recovery, and post-incident review, with incidents classified by severity. Production systems are monitored with automated alerting. In the event of a confirmed breach affecting customer data, we notify affected customers without undue delay and no later than 72 hours after confirmation, including known impact, remediation steps, and a named contact — supporting customers' obligations under the NZ Privacy Act 2020, the Australian Notifiable Data Breaches scheme, and GDPR. The plan is exercised at least annually.
Business continuity and vendor continuity
Availability & DR. Services are backed up daily with encrypted backups; restores are tested at least annually. Recovery objectives for core detection services are RTO 24 hours and RPO 24 hours. Importantly, the browser extension fails safe: if the SafeToOpen cloud is unreachable, local protection in the browser continues to operate and normal browsing is never blocked — a cloud outage degrades detection of brand-new threats but does not interrupt customers' work.
Vendor continuity. We answer the small-vendor question directly rather than avoiding it: SafeToOpen maintains documented operational procedures for running the service, contractual data-return commitments on exit (§4), and offers a source code escrow arrangement as a contract option for enterprise agreements. Details are available to customers under NDA.
Sub-processors and supply chain
A current list of sub-processors with locations and purposes is published on our Trust Center (see SafeToOpen Sub-Processor List). Sub-processors are assessed before onboarding, bound by data protection terms, and customers are notified at least 30 days before a new sub-processor processes customer data.
Certifications and how to verify
Our ISO/IEC 27001:2022 certificate is published on the Trust Center. Under NDA, customers may additionally request: the Statement of Applicability, latest surveillance audit summary, penetration test summary letter, insurance certificate of currency, and our completed security questionnaire (CAIQ). Requests: [email protected] — typical turnaround one business day.
Shared responsibility
SafeToOpen secures the service. Customers remain responsible for managing their own user access and deployment configuration, keeping browsers and the extension up to date, acting on the alerts the product raises, and the security of their own networks and endpoints.
Contact
Security: [email protected] · General: [email protected] · SafeToOpen Ltd, Auckland, New Zealand
Document control: v1.0 · Approved by the Managing Director · Next review: July 2027. Related: Data Handling & Privacy Statement · Privacy Policy (safetoopen.com/en/privacy) · DPA (safetoopen.com/en/dpa) · Terms (safetoopen.com/en/terms).