Security

This page describes how the OpsMind platform is run today, including its limits. We hold no security certification, and no outside firm has yet tested the platform's security. Where something is planned rather than done, we say so.

Where the platform runs

• The application, its database and call recordings run on a single server in Palestine (West Bank). There is no standby server: if it fails, the service stops until it is restored from backup.
• Public traffic reaches the server through Cloudflare, which provides HTTPS at the edge.
• Phone calls that arrive over SIP pass through our phone switch on a Hetzner server in Germany.
• Live voice conversations are processed by Google's Gemini models, by default on Google Cloud (Vertex AI) in the United States. Web chat and WhatsApp conversations are processed by Google's Gemini API.
• Encrypted backups are stored in Google Cloud Storage in Frankfurt, Germany.
• Every provider that receives personal data is listed in our sub-processor list.

Separation between customers

Every record carries the ID of the workspace it belongs to, and the application filters every query by that ID. The database does not enforce this separation a second time, and call recordings are stored in one folder, named by call ID.

Encryption

• Connections to the platform use HTTPS, with HSTS.
• Credentials you connect for other systems, such as CRM tokens, are encrypted in our database.
• Backups are encrypted on our server before they leave it.
• The server's disk is not encrypted by its operating system.

Access

• Access is role-based and checked on the server. The roles are platform administrator, partner, reseller, workspace admin and workspace user.
• Sign-in attempts are rate-limited. Single sign-on with OpenID Connect (OIDC) and user provisioning with SCIM 2.0 are available. SAML is not supported.
• OpsMind staff can open a customer's workspace only if they hold the platform-administrator role. Not every such access is logged yet.

Logs and monitoring

• Application logs are kept on the server for up to 30 days, and only OpsMind engineers can read them. We mask phone numbers and email addresses in them; until that covers every service, they can contain phone numbers, and they can contain message text.
• An automated test runs the main customer journeys every morning, and a backup check runs every 5 minutes. Both email us when they fail.
• The status page shows the database, the queue and the background worker. It does not yet show the voice service.

Backups and recovery

• The database is copied every night, and files, including call recordings, every 15 minutes, to encrypted storage in Frankfurt.
• We keep 14 daily and 4 weekly backup versions. A deleted backup stays recoverable for 30 more days.
• We tested a full restore on 28 September and 3 October 2026, and repeat the test monthly. On a new machine, the database was back in under 2 minutes.
• A disk failure could lose up to 24 hours of database changes.
• Our targets are to lose no more than 24 hours of database data and to restore service within 4 hours. These are targets, not a guarantee.

Application security

• Webhooks are sent only over HTTPS, only to public addresses, and are signed with HMAC-SHA256.
• We do not yet run automated scanning of the software libraries we depend on.
• Report a vulnerability to hello@opsmind-tech.com.

Compliance

• We process personal data under the UK GDPR. Our role as processor for your workspace data is set out in the Data Processing Agreement.
• We hold no security certification, and we do not offer certified processing of payment-card or health data. Do not use the platform to collect payment-card numbers or health records.
• If a personal-data breach affects your workspace, we will tell you without undue delay, and no later than 72 hours after we become aware of it.

Questions about this document? Contact hello@opsmind-tech.com.

OpsMind Technologies Ltd · Registered in England & Wales · Company No. 16946193 · Registered office: 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom · Information Commission (ICO) registration ZC166859.