Security

Readable top to bottom.

OpslyIQ holds payroll estimates, bank balances and clock-in photographs — the most sensitive records a restaurant has. Here is exactly how they are held, and where the limits are. There is no version of this page with the awkward parts removed.

What it does

Reads and computes

Sales, punches, counts and the bank balance — read to catch a shortfall and to price what a shift cost.

What it never does

Initiate a transfer

It does not file a return, does not remit, and cannot move a pound. There is no code path that could — stronger than a policy saying it should not.

In plain English.

How your data is actually held, control by control.

In place todayEvery control below, shipped

Tenant isolationEnforced by the database, not the appEvery operator's data is walled off in the database itself with row-level security — a rule checked on every read and every write. If application code had a bug, the database would still refuse another tenant's row. A dedicated isolation suite runs on every change that touches it.

Secrets at restVaulted or hashed, never a plaintext columnRegister and bank tokens, Social Security numbers, direct-deposit details — written to an encrypted vault and referenced by an id that is only readable server-side, or one-way hashed where the cleartext is never needed. An automated gate blocks any change that would introduce a plaintext secret column from merging at all.

Access controlDeny by default, scoped to a locationA manager sees their rooms and not the group. Permissions are checked on the server, never merely hidden in the interface. Sensitive actions — rotating a secret, changing auth policy, running payroll — require a second factor at the moment you do them.

Separation of dutiesAn administrator cannot run payrollAdministrator rights are a deliberately reduced set rather than a superset of everything. Deprovisioning or a role downgrade revokes active sessions on the next request, not whenever the token happens to expire.

Audit logAppend-only, with before and afterEvery sensitive mutation records what changed, from what, to what, and who did it — the record procurement asks for, and the one you want the day you need to answer it yourself.

The copilotRedacted, read-only, capped and tracedInputs are stripped of personal data before they reach a model. Queries are read-only and confined to your own rows by the same row-level security above. Spend is capped per tenant, and every call is traced.

SOC 2

Not certified. A Type II report requires an observation window, and ours has not started — so nobody can hand you one, and we will not imply otherwise. The technical work underneath it — access control, tenant isolation, audit evidence — is built and documented, which is the part that would be examined. That is the honest position, and it is a worse sentence than a badge would be.

Single sign-on

Built, and not yet run against a real identity provider. Directory sync and two-factor login are shipped and exercised. The SAML round-trip with a live provider needs a customer's own directory to test against, and that has not happened yet.

Penetration test

Not commissioned. When one is, the summary goes here rather than into a sales conversation.

If any of those three is a hard requirement for you, say so before you start rather than after. It is a better conversation than discovering it in a security review.

What we are not.

A security page that lists only what a company has is a sales document. These are the three things a procurement review will ask for that we cannot hand over today.

Who else touches it

Every third party that may process your data.

Several are engaged only when you choose to connect them — your register, your bank. A reviewer will check this list, so it is kept accurate rather than short.

Sub-processor	What it handles	Region
Supabase	Database, authentication and file storage	United States
Vercel	Application hosting and CDN	United States
Trigger.dev	Runs the overnight jobs — the sync, the nightly computation	United States
Clover / Square	Register data — only once you connect your register	United States
Plaid	Bank connection — only once you connect a bank	United States
Anthropic	The copilot. Inputs are stripped of personal data before they are sent	United States
Sentry	Error and performance telemetry, secret-scrubbed	United States
Stripe	Billing and payment processing	United States
Resend	Transactional email — invites and alerts	United States
PostHog	Product analytics, cookieless	United States
Google	Places and Maps — address autocomplete during setup	United States

Found something?

Email hello@opslyiq.com. We will acknowledge it and work it through with you — responsible disclosure, and no legal threats for good-faith research.

Procurement asking?

A Data Processing Agreement, a completed security questionnaire, or our current SOC 2 position — ask and you will get the real answer, including where it is "not yet".

This page describes the product's security posture in good faith. It is not a contract.

Read it, then decide. That is the point.

Anything here you want in more detail, ask.

Start free — no card How connections are held

14 days free · no card · cancel in one click