Opsy is the operating memory for founder-led businesses. That memory is worthless if you can't trust where it lives. Here's exactly how we protect it — and how you can lock it down further.
Your data is encrypted in transit with TLS 1.2+ and at rest with AES-256. BYO API keys are decrypted only inside the server pipeline that needs them, using a master secret that never leaves the runtime. Opsy is designed against the CASA Tier 2 controls required for Google restricted-scope access.
Every workspace is a hard boundary. Row-Level Security policies on Postgres enforce that documents, chunks, embeddings, conversations, gaps, playbooks, and SOPs are only ever readable by members of the workspace they belong to — regardless of what code runs above.
Owners and admins can plug in their own OpenAI and Gemini keys in Settings. When configured, every embedding, chat, transcription, and categorization call in that workspace is billed to and routed through your own provider account — your prompts never touch our shared platform key.
BYO keys are encrypted with AES-256-GCM using a server-only master secret before they hit the database. Plaintext keys never leave the server after save — even admins looking at their own workspace only see a masked hint.
We do not train models on your content. Retrieved chunks are used only to answer your team's own questions, and are scoped to your workspace at query time via a security-definer match function that checks membership before returning a single row.
Uploads go through a same-origin server route using signed sessions, not cross-origin storage POSTs. Slack ingestion verifies every webhook with the workspace's own signing secret before writing a single row.
Service-role access is used only for verified webhook writes, admin operations, and privileged pipeline steps — and only after the caller's role is confirmed. All user-facing reads go through the signed-in user's session so RLS applies.
For teams that need physical isolation — separate database, separate storage, separate keys — we offer a dedicated single-tenant deployment. Get in touch via your workspace owner and we'll spin one up in your region of choice.
Questions about our security posture? Reach out through your workspace admin — we're happy to share our current controls.