Trust
Security
This page summarises how we protect the website and the OpCerto product, and how to report a problem.
Website
- Served only over HTTPS, with HTTP Strict Transport Security.
- Security headers restrict framing, scripts and content sources.
- Form submissions are checked, size-limited and forwarded by email. They are not stored in a website database.
OpCerto product
- Designed to run on the customer's own computer or private server, so order documents stay under the customer's control.
- Signed-in access with separate roles for administrators, operators and read-only reviewers.
- Original documents are kept unchanged and fingerprinted, and every decision is recorded in a history log.
- Encrypted backup and recovery tooling.
OpCerto is in early deployment. Security requirements for each customer installation are agreed in writing before any real data is processed. We do not claim any security certification.
Report a vulnerability
If you find a security issue, email [email protected] with the subject "Security report". Please give us reasonable time to fix it before disclosing it publicly, and do not access or change data that is not yours.