Security posture
How Caisson secures the controls it generates and this site itself — fail-closed RLS, a resolve-and-recheck SSRF guard, timing-safe secret comparison — with the residuals stated, not hidden.
Trust
Subprocessors and the security story.
Caisson is open-source software that runs on your own infrastructure — there is no Caisson-hosted service to depend on. This page covers the one third party that processes data for caisson.sh itself, the shipped security posture, and a name to email when you need more.
Security
The posture, stated precisely.
Caisson generates the evidence a security review asks for; it is not an auditor, and never claims to be. The shipped story lives on these pages — read them, run the controls, and put your own reviewer's name on the result.
Evidence pack
The proof artifacts a review asks for, already shipped: OSCAL conformance in CI, the standards gate, byte-identical registry provenance, real S3 Object-Lock WORM verification, and the append-only audit chain.
Control coverage
The technical controls the SOC 2 and HIPAA frameworks require, and the boundary between what Caisson ships and what stays your organization's responsibility.
Subprocessors
Who processes what.
Caisson the software runs inside your own infrastructure, and your application data stays there. The service below processes data for the Caisson service itself — this website — not your application data.
| Processor | Purpose | Data categories | Region |
|---|---|---|---|
| Cloudflare | Hosts caisson.sh as a static site (DNS, edge delivery, WAF) and runs its cookieless Web Analytics. |
| Global edge network |
This list is a maintained artifact: a new external service that processes data for the Caisson service lands a row here in the same change that introduces it.
Get in touch
For a security questionnaire, a data-flow diagram, or a vulnerability report, email security@caisson.sh. For anything else, email support@caisson.sh.