Security at OpenV2

Q: Where should I keep API keys for my app?

Use server scope in Secrets for private keys, and use them in server functions. Anything in client scope can be extracted from a distributed app.

This page explains how OpenV2 handles the sensitive parts of building an app: accounts, project data, your app's backend, secrets, store credentials and payments. It describes practices documented in our product docs. It does not claim certifications we do not hold.

Your account

You sign in to OpenV2 with Google or GitHub. There is no OpenV2 password to leak.
Your OpenV2 account is separate from your app's users. App users are managed by V2 Cloud, not by your OpenV2 login.

Your projects

The code OpenV2 generates is yours. Paid plans can download a ZIP.
Private projects are a paid-plan feature (see Plans and usage). How sharing and visibility work is described in Sharing and visibility.
Project collaborators are invited by the owner. See Collaborators.

Your app's backend (V2 Cloud)

Each project has its own backend connection and configuration.
Administrative credentials stay on the server. The generated app contains public service URLs, not database passwords.
Ask OpenV2 to apply row level security so each signed-in user reaches only the intended records.
Secrets have two scopes. Client values can be extracted from a distributed app, so private keys belong in server scope and are used only by server logic.
Enter secret values in the Secrets screen, not in chat.

See V2 Cloud overview, Authentication and Secrets.

Store credentials

Apple. Companion signs test builds on your PC. Apple sign-in and device signing run locally. You enter your Apple password in Companion, never in chat or secrets.
Google Play. OpenV2 never asks for your Google password. Your Google credentials and upload key stay encrypted on OpenV2's servers. Only the upload key goes to the build machine, and your source files and prompts never receive it.

See Companion for Windows and Publish to Google Play.

Payments

Subscriptions for OpenV2 plans are paid through Stripe Checkout. We do not store your card details.
In your own app, RevenueCat handles purchases. You never paste its key into chat.

What we do not claim

OpenV2 does not currently publish a third-party compliance certification on this page.
An upload to App Store Connect or Google Play is not an approval. Review stays with Apple and Google.
Managed V2 Cloud sign-in does not include Sign in with Apple.

Privacy and data protection

Our Privacy Policy explains what data we store and your GDPR rights. See also Terms, Cookies and the Acceptable Use Policy.

Report a security issue

Email [email protected] with the details and a way to reach you. Please give us reasonable time to respond before you share anything publicly.

Frequently asked questions

Does OpenV2 store my Apple password?

Apple sign-in for device signing runs locally in Companion on your PC. Enter your Apple password only in Companion's sign-in form.

Where should I keep API keys for my app?

Use server scope in Secrets for private keys, and use them in server functions. Anything in client scope can be extracted from a distributed app.

Can other people see my project?

On the Free plan projects are public: anyone with the link can view them, and they can appear in Discover to be remixed. On Pro and Max you can make a project private, and then only people you invite can open it. See Sharing and visibility.