Security & your data

Everything is hosted in the United States — the database in AWS US-West (Oregon) and the application and file storage on Vercel in the same region. Data is encrypted in transit and at rest.

Every query filters by the caller’s organization, and that organization is re-resolved from the database on each request rather than trusted from the device. That filter is applied on every query that touches your data, and the photo endpoint re-checks organization membership separately. In practice one client does not see another’s properties, assets, workers, logs, or photos.

The exception is Opzaco platform support, which has cross-organization access for troubleshooting. Switching into your organization is recorded in your audit trail, as is every full-size photo view — but not every individual record a support operator reads.

• Storage is private. A raw storage link does not resolve without authorization.
• Photos are served through one endpoint that checks you are signed in and belong to the owning organization.
• GPS and camera metadata is stripped on the server before a photo is shown — including iPhone HEIC files, which are the ones most likely to carry a location.
• Every full-size photo view is recorded in the audit trail.

A dedicated audit log records consequential actions — staff changes, role changes, deletions, photo views, support organization switches: who acted, what they touched, what changed, the IP address, and when. It keeps a snapshot of who the actor was, so attribution survives even if that account is later removed. Archiving or restoring a property or an asset is recorded, so equipment disappearing from a dashboard always has a name and a timestamp against it. Coverage is broad rather than total: routine reads are not recorded, and neither is a support operator’s individual page views once they have switched into your organization — that switch itself is.

The log is immutable at the database level — a database rule rejects every attempt to update or delete a row, and an organization cannot be deleted while audit rows reference it.

Submitted service logs cannot be edited — not by a worker, a supervisor, or an owner — and each one freezes a snapshot of the form it was filled against; see Service logs. Editing a form today cannot change what a log from last year means.

Identity is handled by Clerk, not by Opzaco — we never see raw passwords or verification codes. Managers sign in with email and password, Google, Apple, or a passkey. Workers normally use a one-time code sent to their enrolled phone number, and can also use an email/password or linked Apple account if one is set up for them. Sign-up is restricted, so an unknown identity cannot create an account against your organization.

Deactivating a person cuts off every device they are signed in on, on their very next request.

Opzaco relies on a small set of US-hosted providers. None of them trains AI on your data.

Clerk

Identity and sign-in — names, emails, phone numbers, credentials, sessions.

Neon

The database — organizations, users, assets, service logs, notes, AI question history, audit log.

Vercel

Hosting, file storage for photos and manuals, plus first-party usage and performance telemetry.

Anthropic

Claude, reached through the Vercel AI Gateway. Used only by Ask the Manual, with zero-data-retention set on every request.

Resend

Transactional email, including receipt delivery.

PostHog

Product analytics, feature flags, error tracking, and session replay of the web dashboard, with typed input masked. It receives usage events, the signed-in person’s name and email, error reports with stack traces (query parameters and bound database values redacted), and build-time source maps for readable traces. It never receives your manuals or photos.

Cloudflare

A bot check on the sign-in page only, via Clerk.

YouTube

Only when an asset has instruction videos, and only for the person watching them.

Opzaco publishes what is not finished rather than implying everything is. Currently open:

• Read-only mode for Opzaco platform support is operational policy, not yet a code-level restriction.
• Signing out one specific lost phone is not yet possible — deactivating the person cuts off all their devices instead.
• The browser content-security policy runs in observe-only mode; making it blocking is the next step.
• A tamper-evident hash chain on the audit log is planned.

A dated remediation list, and the specific contractual citations for each provider, are available on request.