Security

Accounts are protected by email and password sign-in, with optional Google sign-in. Passwords are stored as salted hashes by our authentication provider and are never visible to OperMae staff.

• Email verification is required before an account is fully active.
• Sensitive actions require re-entering your password.
• Sessions can be signed out from your account settings.
• Access inside a business is limited by role-based permissions.

All traffic to OperMae is served over HTTPS using TLS. Data stored in our managed database and file storage is encrypted at rest by the hosting provider. Access to stored data is restricted by row-level security policies scoped to each business.

OperMae runs on managed cloud infrastructure. Application code is deployed through an automated pipeline, and production credentials are stored as encrypted secrets rather than in source code. Administrative interfaces are limited to authorised OperMae staff accounts.

The production database is backed up automatically by our hosting provider, with point-in-time recovery available for recent history. Deleted business accounts are held in a recoverable state for 30 days before permanent purge, so accidental deletions can be reversed within that window.

OperMae records application errors, background job health, and message delivery outcomes. Privileged actions such as role changes, booking changes, and account deletion requests are written to audit logs so they can be reviewed after the fact.

If you believe you have found a security vulnerability in OperMae, email [email protected] with the subject line “Security”. Please include enough detail for us to reproduce the issue.

• Give us a reasonable opportunity to investigate before public disclosure.
• Do not access, modify, or delete data belonging to other businesses.
• Do not run tests that degrade service for other users.

We acknowledge reports and will keep you updated as we investigate.

When a security incident is identified, we investigate, contain the issue, and restore normal service. If an incident affects your business or customer data, we will notify affected account owners by email with the information available at the time and follow up as the investigation progresses.

• Stripe

  Payment processing

  Processes payments securely.

• Twilio

  SMS delivery

  Transactional appointment notifications.

• Resend

  Transactional email

  Appointment and account emails.

• Supabase

  Authentication & database

  Secure account authentication and data storage.

These providers process information only as necessary to operate OperMae services and are bound by their own security and privacy obligations.