Most managed hosting providers tell you their platform is secure. We tested ours, and we're publishing exactly what we found — the same way a technical evaluator would expect a rigorous security assessment to be documented.
This is a summary of our full Security Assessment Report for OpenClaw for Business. The complete report, including methodology and detailed findings, is available as a downloadable PDF.
Network Architecture
Customer instances have no publicly routable network address. The only path to a customer's instance runs through a dedicated traffic inspection and routing layer, which enforces authenticated, encrypted access. Customer environments are isolated from one another at both the physical network and virtualization layers — confirmed through direct connectivity testing between live instances, across multiple deployment scenarios.
Perimeter Security
All customer-bound traffic passes through a carrier-grade, next-generation firewall with active intrusion prevention, inspecting traffic against known attack signatures before it ever reaches a customer instance. Two independent layers of denial-of-service protection are in place: edge-level scrubbing ahead of the platform, plus dedicated flood and scan protection at the network perimeter. Administrative access requires a second, independent authentication factor beyond the primary credential.
Application Security
The full application codebase was assessed with Bandit, an industry-standard static analysis tool for Python applications.
The live, running application — including the public-facing WebChat interface — was tested with OWASP ZAP, the industry-standard open-source dynamic security testing tool, in both passive and full active adversarial modes. Active testing ran 135 distinct checks, including SQL injection across multiple database engines, several classes of cross-site scripting, server-side request forgery, and XML external entity injection.
All user-supplied identifiers that influence system-level operations are validated against strict, safe character allow-lists before any further processing, and system-level operations are constructed without shell interpretation of user-supplied values — confirmed through manual, hands-on adversarial testing, including live exploitation attempts against every code path where user input reaches a system-level operation.
Platform Configuration
The deployed platform configuration was assessed using openclaw-carapace, an open-source auditor purpose-built for the underlying OpenClaw platform, evaluating 110 automated checks spanning configuration hardening and known, publicly-tracked vulnerability exposure.
Data Protection
Platform credentials are never stored in plaintext — sensitive values are held as protected references, resolved only at runtime. All external traffic is encrypted via TLS. Customer instances are backed up automatically on a daily schedule, with defined retention, to dedicated backup storage.
An Ongoing Practice
Security assessment of the OpenClaw for Business platform is continuous, not a one-time exercise. Platform configuration and known-vulnerability exposure are re-verified on a recurring basis, and following every platform upgrade, using the same methodology and tooling described here.
Read the full report
This post summarizes our published Security Assessment Report. For full methodology, scope, and detailed findings:
Download the Full Report (PDF)