Your data, in Canada, with a record of every change.
This page says plainly where your data lives, how it is protected and who can reach it. If you need a security questionnaire filled in, write to adeelimtiaz@issaber.ca.
Hosted in Canada
The application, database and file storage run in the AWS Canada (Central) region. Data does not leave the country to be processed.
Encrypted at rest and in transit
TLS 1.2 or newer on every connection. The database volume and every stored file are encrypted at rest. Fields that hold sensitive personal data get a second layer of AES-256-GCM encryption inside the application.
One workspace per company
Each company has its own subdomain and every record carries its company identity, enforced by the data layer on every query. Cross-company access is tested automatically on every release.
Two-factor sign-in
Time-based one-time codes (TOTP) with standard authenticator apps. Rate-limited sign-in, account recovery and invitations are built in.
Permissions per module
Admin, Manager and Staff roles out of the box, plus your own. Read, write, delete and settings are separate rights on every module, down to individual fields where it matters.
Immutable activity log
Every create, update and delete is written to an append-only activity log in the same transaction as the change. Records are archived, never hard-deleted.
Backups
Automated daily database backups retained for 14 days, with deletion protection on the database itself. Stored files are versioned.
Payments and card data
Online payments run through your own Stripe account. Card numbers never reach OpSaber; we store only the tokens and the amounts.
No secrets in the wrong place
Passwords are hashed with BCrypt. Third-party tokens are encrypted before they are stored. Deploys use short-lived cloud credentials, not long-lived keys.
Retention and export
Document retention is a per-company policy you control. Business records are archived rather than deleted so that history stays auditable. You can export your data at any time, and on termination we return it and remove it on a schedule agreed in writing.
Who operates it
OpSaber is built and operated by Issaber Inc., a Canadian company. Operator access to customer workspaces is limited to a break-glass path that is logged, and is used only to resolve an incident you have raised.
Reporting a vulnerability
If you believe you have found a security issue, write to adeelimtiaz@issaber.ca. We acknowledge reports within two business days.