SECURITY
How we look after your system, stated plainly.
This page describes how systems we build and host are protected today. It does not claim certifications we do not hold. When that changes, this page will.
01 / HOSTING AND DATA
Where it runs and where the data lives.
- Region
- Australian region by default. United Kingdom or Singapore regions on request for overseas customers. Data does not leave the chosen region except for the third-party services you connect, such as your accounting system or payment provider.
- Isolation
- Each customer’s system has its own database and its own credentials. There is no shared multi-tenant table.
- Encryption
- TLS 1.2 or higher in transit. Encryption at rest on the database and on backups using the hosting provider’s managed keys.
- Card data
- Never touches our systems. Payments are handled by the payment provider, and we store only the provider’s tokens and references.
- Backups
- Automated daily backups retained for 30 days, plus point-in-time recovery on the database. Restores are tested when a system goes live and quarterly after that.
02 / ACCESS AND OPERATIONS
Who can see what, and who is watching.
- Customer access
- Role-based permissions in your system. Customers, staff and owners see the views they are granted. Every write is logged with who and when.
- Our access
- Named engineers only, with individual credentials and multi-factor authentication. Production access is logged. We do not use customer data for anything other than running and supporting your system.
- Monitoring
- Uptime, error and performance monitoring on every system we host, with a person on call. Customers on a monthly plan are told about incidents that affect them, not just the ones they notice.
- Updates
- Security patches to the platform and its dependencies are applied across every system we host as part of the care plan.
- Export and exit
- Full export of your data as CSV and JSON from the admin at any time. On exit, data is handed over and then deleted from our systems within 30 days, with confirmation.
03 / WHAT WE DO NOT CLAIM
Certifications and audits.
Opus Works does not currently hold SOC 2, ISO 27001 or IRAP certification. We operate to the practices above and will answer a security questionnaire in full. If your procurement requires a certification, tell us early and we will say whether and when we can meet it.
Security concerns and vulnerability reports: info@opusworks.com.au, subject line Security. Acknowledged within one business day.