Trust · Security

Built to be quiet about your data

The shorter version: encrypted in transit, encrypted at rest, and masked at the boundary before it ever reaches us.

01

Encryption

  • TLS 1.2 and 1.3 only for all data in transit.
  • AES-256 encryption at rest, provided by our hosting platforms.
  • Integration credentials encrypted by us with AES-256-GCM.
  • Off-droplet database backups every six hours to a London bucket, encrypted before they are uploaded, with thirty daily and thirteen monthly snapshots kept.
02

Infrastructure

  • Logical tenant separation: every record is scoped to your organisation and every query is checked against your membership.
  • HTTPS enforced end to end, with automated certificate renewal.
  • Per-IP rate limiting and connection ceilings at the edge.
  • Unknown hosts refused outright by a default-deny virtual host.
  • We hold no security certification and no third-party audit report.
03

Privacy controls

  • Automatic PII masking in session recordings.
  • Configurable data retention windows.
  • Element-level masking for sensitive UI.
  • Network request filtering at the SDK boundary.
04

Access control

  • Role-based access control across the organisation.
  • Single sign-on (SAML, OIDC) is on the roadmap and is not available on any plan today.
  • Project transfers are recorded with the person who made them; every field change on an issue is recorded with the person who made it. Nothing else is audited yet.
  • Scoped API keys you create and revoke yourself.
05

Report a vulnerability

Found something? Send the details and a way to reach you to security@optics-qa.com. We acknowledge within 48 hours and credit responsible reporters in our changelog.