Section 01
Authentication
How accounts are accessed and protected.
Accounts are protected by email and password sign-in, with optional Google sign-in. Passwords are stored as salted hashes by our authentication provider and are never visible to OperMae staff.
- Email verification is required before an account is fully active.
- Sensitive actions require re-entering your password.
- Sessions can be signed out from your account settings.
- Access inside a business is limited by role-based permissions.
Section 02
Encryption
Data in transit and at rest.
All traffic to OperMae is served over HTTPS using TLS. Data stored in our managed database and file storage is encrypted at rest by the hosting provider. Access to stored data is restricted by row-level security policies scoped to each business.
Section 03
Payment Security
Card data never touches OperMae servers.
Payments are processed by Stripe. Card details are entered directly into Stripe’s hosted payment elements and are never stored on OperMae servers. OperMae keeps only non-sensitive references such as payment status and the last four digits returned by Stripe.
Section 04
Infrastructure
Where OperMae runs.
OperMae runs on managed cloud infrastructure. Application code is deployed through an automated pipeline, and production credentials are stored as encrypted secrets rather than in source code. Administrative interfaces are limited to authorised OperMae staff accounts.
Section 05
Backups
How data is retained and recoverable.
The production database is backed up automatically by our hosting provider, with point-in-time recovery available for recent history. Deleted business accounts are held in a recoverable state for 30 days before permanent purge, so accidental deletions can be reversed within that window.
Section 06
Monitoring
Detecting problems early.
OperMae records application errors, background job health, and message delivery outcomes. Privileged actions such as role changes, booking changes, and account deletion requests are written to audit logs so they can be reviewed after the fact.
Section 07
Responsible Disclosure
Reporting a vulnerability.
If you believe you have found a security vulnerability in OperMae, email support@opermae.com with the subject line “Security”. Please include enough detail for us to reproduce the issue.
- Give us a reasonable opportunity to investigate before public disclosure.
- Do not access, modify, or delete data belonging to other businesses.
- Do not run tests that degrade service for other users.
We acknowledge reports and will keep you updated as we investigate.
Section 08
Incident Response
What happens if something goes wrong.
When a security incident is identified, we investigate, contain the issue, and restore normal service. If an incident affects your business or customer data, we will notify affected account owners by email with the information available at the time and follow up as the investigation progresses.
Section 09
Third-Party Providers
The services that operate parts of the platform.
Stripe
Payment processing
Processes payments securely.
Twilio
SMS delivery
Transactional appointment notifications.
Resend
Transactional email
Appointment and account emails.
Supabase
Authentication & database
Secure account authentication and data storage.
These providers process information only as necessary to operate OperMae services and are bound by their own security and privacy obligations.
Still have questions?
Contact our support team if you need clarification regarding these documents.
Contact Support