Built to a SOC 2 and
ISO 27001-ready posture.
AES-256 at rest. TLS 1.3 in transit. Role-based access control. Two-year audit log retention. Daily backups with point-in-time recovery. AU & NZ data residency. Formal certification underway.
- At restAES-256
- In transitTLS 1.3
- Audit log retention2 years
- BackupsDaily · point-in-time
Every claim, with current status.
What's live today and what's still in the certification queue. We don't list controls we haven't shipped.
- AES-256 encryption at restLiveAll customer data + backups
- TLS 1.3 encryption in transitLiveAll API + browser traffic
- Role-based access controlLive14 predefined roles, customizable
- Audit loggingLiveEvery state change · 2-year retention
- Daily automated backupsLivePoint-in-time recovery
- AU & NZ data residencyLiveIn-region hosting per domain
- SOC 2 control postureIn progressAligned · formal certification underway
- ISO 27001 control postureIn progressAligned · formal certification underway
Four control layers, documented end-to-end.
Authentication
How users prove who they are.
- JWT-based authentication with access tokens (8hr expiry)
- Refresh tokens with 7-day validity
- Password security: bcrypt hashing (10 rounds)
- Password strength validation (8+ chars, mixed case, numbers)
- Session management with token rotation
- Secure token storage
Authorization (RBAC)
What each authenticated user can see and do.
- 14 predefined user roles
- 15+ permission categories
- View/create/edit/delete permission levels
- Role switching for admin support
- Granular access control
Data protection
How data is encrypted, stored, and isolated.
- Input validation with Joi schemas
- SQL injection prevention via parameterized queries
- XSS protection with input sanitization
- CSRF protection via origin validation
- Rate limiting (100 req/15min for auth, 30 req/min for writes)
- Security headers (CSP, X-Frame-Options, etc.)
Audit & monitoring
How activity is recorded and reviewed.
- Complete audit trail for all API requests
- 2-year log retention
- Change tracking with old/new values
- SOC2/ISO27001 audit capabilities
Layered controls at every tier.
Encryption
AES-256 at rest. TLS 1.3 in transit. Keys rotated on a documented schedule.
Infrastructure
In-region cloud hosting (NZ for opsui.co.nz, AU for opsui.au). Network isolation per tenant.
Monitoring
Continuous logging + alerting on auth, privilege escalation, and unusual data access.
Backups
Daily automated backups with point-in-time recovery, retained per data-residency rules.
Incident response
Documented incident response procedure with on-call rotation and customer notification SLA.
Availability
99.9% uptime SLA target. Redundant components at compute, storage, and network layers.
Controls we've committed to ship.
Quarters are best-effort targets, not contractual commitments. Procurement teams can request the working timeline directly.
- Q2 2026Multi-factor authentication (MFA)In progress
- Q2 2026Password expiry & rotation policyPlanned
- Q3 2026Account lockout after failed attemptsPlanned
Procurement or compliance review?
We can walk you through controls, hand over the security questionnaire, and answer specific compliance asks before you sign anything. OpsUI is built for ANZ data residency, audit logging, and RBAC out of the gate.