Security & trust
Security you can verify — not just claims.
OPEREX is built for regulated, continuous-process plants, where the operational record has to hold up to an audit. Here is what protects your data today — measured, not aspirational — and, just as plainly, what we do not claim yet.
What protects your data today
Access & identity
- Invite-only access — no public self-registration; every account is provisioned with its tenant and role.
- Two-factor authentication (TOTP) required for platform administrators; a per-tenant switch enforces it for tenant admins too.
- Role-based access control, fail-closed — even a super-admin cannot cross a tenant boundary (verified by tests).
- Server-side token verification on every request; role and tenant come from the database, never from a client field.
- Rate limiting on login, password reset and uploads at the application layer.
- Offboarding by deactivation — access is revoked while the audit trail stays intact.
Tenant isolation — two independent layers
- Every tenant-scoped query filters by tenant explicitly in application code.
- Database Row-Level Security (FORCE RLS) enforced at runtime on a role without BYPASSRLS — a missed filter is still caught by the database.
- Coverage is gated on every deploy: a table missing RLS stops the deploy.
- Cross-tenant isolation measured against two real tenants and tested in CI (mutation-verified).
- The audit trail is append-only, enforced at the database level — no silent rewrite or delete.
- Every push runs an automated dynamic scan (OWASP ZAP) against a production build of the application, checking what a browser actually receives: security headers, cookie flags, cache directives and information disclosure. A finding stops the pipeline, and every accepted exception carries a written justification.
Data & residency
- Self-hosted database and object storage on EU (Hetzner) infrastructure — no third-party processor for your database.
- EU data storage (GDPR). Transactional email is delivered by a US provider (Resend) under the EU–U.S. Data Privacy Framework.
- Off-site encrypted backups every 6 hours to EU object storage (Cloudflare R2), self-verifying, with a 90-day weekly tier.
- On-premise / air-gapped deployment is packaged for enterprise (installer, container compose, no vendor lock-in) — the data never leaves the site.
Application hardening
- No SQL injection, stored XSS, CSRF, open redirect, mass-assignment, CSV injection or SSRF — verified by a static audit and its fixes.
- Every application page carries a Content-Security-Policy with a per-request nonce (no inline scripts), HSTS, X-Frame-Options DENY, nosniff, a strict referrer policy and a restrictive Permissions-Policy that switches off camera, microphone, location and payment access.
- Authenticated pages are never cached (no-store); the application is excluded from search indexing.
- Image uploads are re-encoded server-side (WebP, EXIF stripped) with size and decompression-bomb limits.
- Infrastructure hardened — internal services bound to localhost, public storage download-only, private storage reachable only through an authenticated proxy.
- Availability and system health are watched by an external monitoring service every five minutes, with alerting — the application and the database through a real database query, the file store separately. Monitoring is not redundancy: see what we don’t claim, below.
Portability & data sovereignty
- A CI-enforced blocklist keeps the code vendor-neutral — it runs on vanilla Postgres and object storage, air-gapped, with no code rewrite. Identity sits behind the same adapter boundary, so an enterprise identity provider can be added without touching business logic.
- Secrets never live in the repository; they are generated and held on the server.
What we don’t claim — yet
We would rather be precise than impressive. As of today:
- Independent penetration testing is planned ahead of the first enterprise engagements.
- The automated scan covers the signed-out surface. Scanning the signed-in surface needs a full identity provider inside the pipeline, which is not in place yet.
- No formal ISO 27001 certification. OPEREX supports ISO 45001 record-keeping (§7.5) and incident-investigation (§10.2) practices, but the software is not itself a certification.
- Edge-layer (network) rate limiting is still pending; the application-layer limiter is live.
- No enterprise single sign-on yet (Entra ID / Azure AD is next on the roadmap). Accounts are provisioned by invitation, with two-factor authentication available today.
- The on-premise package is source-complete but has not yet been stood up on a customer machine — a first enterprise deployment is a project we run together, not a download.
- No automatic failover: the service runs on a single server, with off-site backups every 6 hours. We restore-tested those backups end to end on 9 September 2026 — every stored record and document came back intact, and the data itself restores in seconds. The full recovery time, including rebuilding a machine, is still being measured and will be stated here once we can back it with a number.
Current stage
OPEREX is in an early-access / pilot phase — the core runs in production. This page describes the security of the system as it stands, and is kept current as it evolves.
Legal & data protection
The formal documents behind the statements on this page:
A security question we didn’t answer here?
Talk to usLet's start a pilot
We'll show you OPEREX on your own operational processes — no strings attached.
Request a demo