A single source of truth for OpenHive's security posture. Every control, audit, policy, and incident — in one place, always current, available to your procurement team in under five minutes.
Welcome to OpenHive's Trust Center. We build agent-native infrastructure for operators who cannot afford a bad day — so we treat the platform's security posture like we treat our runtime: observable, versioned, and reproducible.
Every certification on this page is independently audited. Every document is version-pinned. Every incident is written up within 72 hours, whether or not you'd ever notice. We run the control plane for your agents — they run your ops, your finance, and your customer-facing workflows — and that asks for a higher bar than most SaaS.
This Trust Center is a reflection of our security commitments. If you need evidence that isn't here, email security@hive.dev — we reply within one business day.
Our annual SOC 2 Type II observation window closed on January 31, 2026. We received a clean report — zero exceptions across the Trust Services Criteria: Security, Availability, Confidentiality, and Processing Integrity.
The full report is available under NDA in the Documents section above. Customers on Business plans can have it sent directly to their procurement contacts.
A high-severity vulnerability was disclosed in libssh2, used by a small subset of our Cloud Hive VM tooling images. We received the advisory at 09:14 UTC and pushed patched images across all regions by 13:28 UTC on the same day.
No exploit attempts observed. The vulnerable path required a specific MITM posture on an internal build path not exposed to customer traffic. No customer data accessed.
Nothing. This patched automatically. If you're running self-hosted workers on Linux and you use libssh2 for side tools, bump to 1.11.3+.
Our security team detected a coordinated phishing campaign sending emails that appeared to be from support@hive-sec.dev (note the hyphen — our real domain is hive.dev). The emails asked recipients to 'reconfirm their agent keys' on a lookalike login page.
If you received one of these emails, please forward it to phishing@hive.dev and delete it. We've published IOCs in our detections repo.