Security

Your Workspace Is Isolated

Every account gets its own workspace, and every query against your records is scoped to it at the database layer rather than by a filter somebody remembered to apply. One firm cannot read another firm's contacts, events, or messages.

Integration Credentials Are Encrypted At Rest

The credentials you hand over to connect a mailbox or calendar are encrypted in our database and are never stored in plain text. They are decrypted only at the moment a connection is made on your behalf.

To be precise about scope: this covers the credentials themselves. Registrant contact details are protected by workspace isolation, access control, and encrypted transport rather than by per-field encryption at rest.

Everything Is Encrypted In Transit

The entire platform is served over HTTPS and is not reachable any other way. Connections are pinned with HTTP Strict Transport Security, so a browser that has seen the site once will refuse to fall back to an unencrypted connection.

Administrative Actions Are Logged

Actions taken against your account are recorded with who performed them, when, the address they came from, and what changed, including the values before and after. Sensitive fields such as passwords and authentication secrets are masked before anything is written.

Security-relevant events, such as an administrator beginning to act as a customer, a password change, or every session for an account being terminated, additionally raise a real-time alert to our operations channel.

Opt-Outs Are Honored Automatically

STOP and HELP are handled by the platform rather than by anyone remembering to act on them, and quiet hours are enforced on outbound messaging. An opt-out is respected regardless of what any campaign or sequence is configured to do.

Retention

Audit records are retained for two years, and security events for seven, so that questions about what happened to an account can be answered long after the fact. Opt-in and opt-out records are retained even after a number has opted out, because carrier and legal requirements expect us to be able to demonstrate consent.

Payment Data Never Reaches Us

Card details are entered directly into fields hosted by Stripe, a PCI DSS Level 1 validated service provider, and are exchanged for a token in your browser. We receive only that token. Full card numbers are never transmitted to, processed by, or stored on our systems, and there is no card data in our database, our logs, or our backups.

The pages where a card is entered carry a maintained inventory of every script permitted to run on them, and an automated weekly check verifies that the scripts and security headers those pages are served with have not changed. Unexpected changes raise an alert.

Subprocessors

We use a limited set of providers to operate the platform. Each receives only what it needs to perform its function, is contractually bound to protect it, and is prohibited from using it for its own marketing or selling it onward.

The certifications shown against each provider are held by that provider and are not ours. The list is also published on its own at /subprocessors so your compliance team can link to it directly.

What We Do Not Claim

We think a security page is worth more when it is precise about its limits. OPVII has not completed a SOC 2, ISO 27001, or HIPAA audit, and we do not describe ourselves as certified under any of them. If your firm requires a formal attestation before adopting a vendor, contact us and we will tell you honestly where we are rather than point at a badge.

Reporting A Vulnerability

If you believe you have found a security issue, please write to dev@opvii.local with enough detail to reproduce it. We will acknowledge your report, keep you updated while we investigate, and will not pursue action against good-faith research that avoids privacy violations, service degradation, and access to data that is not your own.

Contact

Security questions, due-diligence questionnaires, and vendor review requests can be sent to dev@opvii.local.