How we protect your organisation
OpenCommute is built so community transport teams can keep passenger, booking, and billing data safe — with access limited to the people who need it.
Security measures
Cloudflare and WAF
The application sits behind Cloudflare and a web application firewall to help prevent attacks.
Two-factor authentication
All platform users, including admins, must confirm a code emailed to them before they can sign in.
Roles and permissions
Platform users have roles with different permissions, set per user, so only the people who need access get it.
Audit trail
Actions on the platform are logged so you have a full history of what changed and who did it.
SSL in transit
Current SSL certificates protect data as it travels between your browsers and the platform.
Organisation isolation
Data is scoped to your organisation. Users from other organisations cannot access your records.
Daily backups
The database is backed up every day so your data can be restored if something goes wrong.
UK hosting
Servers run on Amazon AWS, with data isolated to a London data centre.
How you sign in
You create an OpenCommute account and sign in on opencommute.uk. Signup and admin login forms post only to this website. We do not send your password to a third-party login page, and we do not share OpenCommute login credentials with Stripe, GoCardless, chat, or analytics providers.
- Same-origin HTTPS forms on opencommute.uk for trial signup and admin sign-in.
- Cloudflare and a web application firewall in front of the application.
- Production data hosted on Amazon AWS and isolated to a London data centre.
- No bank passwords, no software to install, and no sharing of your OpenCommute password with payment or chat providers.
Report a security issue
Email security@opencommute.uk if you believe you have found a vulnerability in OpenCommute. Include enough detail for us to reproduce the issue, and do not include passenger or payment data.