Security & compliance posture

OpsGuardian is built to monitor compliance in others — so it has to practise what it preaches. Here is an accurate account of how we protect your data, not marketing copy.

Encryption

In transit

All traffic between the OpsGuardian agent and the API, between your browser and the application, and between internal services uses TLS 1.2 or later. We enforce HSTS with a 1-year max-age.

At rest

PostgreSQL data is encrypted at rest at the storage layer. Integration credentials are additionally encrypted at the application layer using pgcrypto AES-256 symmetric encryption before being stored.

Secrets management

Encryption keys are stored in Supabase Vault, isolated from the application database. No plaintext credentials are stored in environment variables or application config.

Tenant isolation

OpsGuardian is a multi-tenant SaaS platform. Your data is logically isolated from every other tenant at the database layer using PostgreSQL Row Level Security (RLS).

Every table with organisation-scoped data has RLS enabled and enforced — no exception.
SELECT, INSERT, UPDATE, and DELETE policies verify the requesting user's organisation membership before allowing access.
Admin-only tables use SECURITY DEFINER functions with a fixed search_path to prevent privilege escalation.
The API layer (Cloudflare Workers) never receives or forwards Supabase's service role key — it uses short-lived JWT tokens tied to the authenticated user.

API security

All client-facing requests go through the OpsGuardian API proxy at api.opsguardian.cloud. The Supabase project URL is never exposed in client code.

Agent requests are authenticated with HMAC-SHA256 signatures — each agent has a unique key that can be rotated or revoked.
Browser requests are authenticated with short-lived JWT tokens issued by the Supabase Auth service.
Rate limiting: 1 000 requests per minute per API key, enforced in the Cloudflare Worker.
Security headers are applied on all responses: CSP, HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin.

Audit logging

Security-sensitive operations are written to the activity_logs table immediately after they occur. Logs are append-only; application users cannot delete them.

User sign-in and sign-out events

Organisation member invitations and role changes

Asset creation and deletion

Alert rule creation, modification, and deletion

Remote command submission, confirmation, and execution

Patch job submission and execution

API key issuance and revocation

Audit log retention follows your subscription tier: 30 days (Essentials), 90 days (Professional), 365 days (Enterprise).

Input security

Parameterised queries only

All database access goes through the Supabase client library using parameterised queries. String concatenation for SQL is not used anywhere in the codebase.
Input sanitisation

All text inputs in the web application strip HTML tags, SQL comments, and null bytes before any processing.
XSS prevention

Any user-generated content rendered as HTML is sanitised with DOMPurify before being written to the DOM.
Dangerous-pattern flagging

Commands containing rm -rf /, mkfs, dd if=/dev/zero, fork-bomb patterns, and curl|sh pipelines are flagged and audit-logged as advisory warnings before execution.

Session & access management

30-minute idle timeout

Sessions expire after 30 minutes of inactivity (PCI-DSS Requirement 8.1.8). Users are redirected to the sign-in page.
Password complexity

Passwords must be at least 8 characters and include uppercase, lowercase, a number, and a special character.
Role-based access control

Three roles: Owner, Admin, Member. Each has a defined permission set. Role changes are audit-logged.
MFA (TOTP)

TOTP-based multi-factor authentication is available. Users can enrol and verify via /mfa-enroll and /mfa-verify in the application.

Data protection & privacy

POPIA & GDPR alignment

OpsGuardian processes personal data in line with the South African Protection of Personal Information Act (POPIA) and the EU General Data Protection Regulation (GDPR). A Data Processing Agreement (DPA) is available to all customers.

Minimum necessary data

We collect what's needed to provide the service. We don't sell data to third parties, use it for ad targeting, or share it with analytics platforms.

Data retention

Metric and log data is automatically purged after your plan's retention window via scheduled database jobs. Audit logs follow the same retention schedule.

Data residency

Application data is hosted on Supabase infrastructure. Edge functions run on Supabase's global network. No data is sent to third-party analytics services.

Right to erasure

You can request deletion of your organisation and all associated data at any time. Account deletion purges all user records, assets, alerts, and logs within 30 days.

No analytics trackers

This marketing site and the application do not include third-party analytics, advertising pixels, or session recording tools.

Compliance frameworks referenced in AI guidance

OpsGuardian's AI engine references control IDs from these frameworks in its remediation guidance. This is guidance-level mapping — not a monitored or evaluated control engine, and not a certification held by Dealt Limited.

Framework	Status	Coverage
ISO/IEC 27002:2022	AI-referenced	Asset management, access control, cryptography, incident management — referenced in AI guidance
CIS Benchmarks (Linux, Windows, K8s)	AI-referenced	Hardening control IDs referenced in AI remediation suggestions
NIST SP 800-53 Rev 5	AI-referenced	Control IDs from AU, SI, SC, and IA families referenced in AI guidance
SOC 2 Type II (TSC)	AI-referenced	CC6, CC7, CC8 control IDs referenced in AI guidance — not monitored coverage
PCI-DSS v4	AI-referenced	Requirements 1, 4, 6, 8, 10 referenced in AI guidance for relevant findings
Custom frameworks	Enterprise	Define your own control mappings for industry-specific standards

Questions about our security posture?

Reach out directly — we'll answer security and compliance questions honestly.