Security

Last Updated: April 2024

1. Our Commitment to Security

At Opygen, security is at the core of our technical architecture. We understand that cleaning businesses trust us with sensitive client data, financials, and staff schedules. We take that responsibility seriously and implement multi-layered security measures to protect your information.

2. Data Encryption

In Transit

All data transmitted between your browser and Opygen servers is encrypted using modern TLS (Transport Layer Security) protocols. This ensures that your information cannot be intercepted by unauthorized parties.

At Rest

Sensitive data stored in our databases is encrypted at rest using industry-standard AES-256 encryption. This provides an additional layer of protection for your business and client data.

3. Data Storage and Infrastructure

Opygen is hosted on AWS (Amazon Web Services), which provides enterprise-grade physical and network security. Our infrastructure leverages best-in-class security controls provided by AWS, and we perform regular automated backups to ensure data durability and rapid recovery.

4. Payment Security

All financial transactions on Opygen are processed by Stripe, a PCI-DSS Level 1 compliant payment processor. Opygen never stores raw credit card numbers or highly sensitive financial data on its own servers, significantly reducing your compliance burden and risk.

5. Access Controls

Role-Based Access Control (RBAC): Our platform enforces strict role-based access. Super Admins, Business Owners, and Staff members see only the data required for their specific roles.
Password Hashing: User passwords are securely hashed using bcrypt before being stored.
Two-Factor Authentication (2FA): Support for 2FA is available for administrative accounts to provide an extra layer of login security.

6. Security Testing and Monitoring

We perform regular internal vulnerability assessments and plan for annual third-party penetration testing as we grow. Our systems are monitored 24/7 for unusual activity or potential security threats.

7. Incident Response

In the event of a verified data breach that impacts personal information, Opygen is committed to notifying all affected users within 72 hours of discovery, detailing the nature of the breach and the steps taken to mitigate its impact.

8. Responsible Disclosure

If you are a security researcher and have discovered a potential vulnerability in Opygen, we encourage you to report it to us responsibly at security@opygen.com. We take all reports seriously and will work with you to address confirmed issues.

9. Contact Us

For any security-related inquiries, please reach out to our security team at security@opygen.com.