Your data, in Canada, with a record of every change.
This page says plainly where your data lives, how it is protected and who can reach it. If you need a security questionnaire filled in before you can proceed, ask us and we will complete it.
Hosted in Canada
The application, the database and your files all run in the AWS Canada (Central) region. Your data does not leave the country to be processed.
Encrypted at rest and in transit
Modern TLS on every connection. The database and every stored file are encrypted at rest, and the most sensitive fields carry a second layer of encryption inside the application itself.
A private workspace per company
Your company has its own address and its own separated records. Separation is enforced by the system on every single query, and it is tested automatically before every release.
Two-factor sign-in
Standard authenticator-app codes, supported throughout. Sign-in attempts are rate limited, and account recovery and invitations are built in rather than handled by email in the clear.
Access by role
People see what their role allows and nothing else. Reading, changing, removing and configuring are separate rights, so a technician does not gain an office manager's reach.
A record of every change
Every creation, edit and removal is written to an append-only log at the moment it happens. Records are archived rather than destroyed, so history stays intact and auditable.
Backups
The database is backed up automatically every day and kept for two weeks, with protection against accidental deletion. Your stored files are versioned.
Payments
Where you take payments, they run through a certified payment provider under your own account, and the money settles to you. Card numbers never reach OpSaber.
Credentials
Passwords are stored hashed, never recoverable. Keys and third-party tokens are encrypted before storage, and our own deployments use short-lived credentials rather than standing keys.
Retention and getting your data out
How long documents are kept is a policy you set. Business records are archived rather than deleted so history stays auditable. You can export your data at any time, and if you ever leave we return it and remove it on a schedule agreed in writing.
Who can reach your workspace
Our access to a customer workspace is limited to a break-glass path that is logged, and it is used only to resolve something you have raised with us. Nobody browses your data.
Reporting a vulnerability
If you believe you have found a security issue, get in touch and mark it as a security report. We acknowledge those within two business days.