Security at Opright

Current safeguards

• TLS encryption for data in transit and managed encryption at rest through infrastructure providers.
• Supabase Row Level Security and company-scoped authorization to separate workspaces and enforce roles.
• Server-only payment, email, and administrative credentials; publishable browser keys are restricted by database policies.
• Hashed capability tokens, short-lived signed file URLs, idempotency records, input validation, and rate limits for sensitive endpoints.
• Stripe-hosted or embedded collection of payment and identity-verification details; Opright does not store full card or bank credentials.
• Minimum 12-character passwords for new owners and a k-anonymous known-breach check that sends only a partial password hash prefix.
• Audit records for payment, subscription, support, and platform-administrator actions.
• Backups, incident procedures, access review, and data-retention controls.

Your responsibilities

Use a unique password, protect devices and email accounts, assign the least access needed, remove former workers promptly, review invoices before sending, and do not upload highly sensitive data Opright is not designed to hold. Treat customer portal links like confidential documents.

Report a vulnerability

Email support@mail.oprightapp.com with “Security” in the subject. Include the affected URL or feature, steps to reproduce without accessing another person’s data, and a safe contact method. Do not disrupt service, use automated high-volume scanning, access or alter data that is not yours, or publicly disclose an unresolved issue. Opright will acknowledge credible reports and provide updates as practical. No bug bounty or authorization for intrusive testing is implied.

Security incidents

Opright investigates suspected incidents, contains risk, preserves necessary evidence, and notifies affected customers or authorities when required. See Service Status & Incident History for published service updates.