Encryption in transit
All connections between your browser or app and Opyris are encrypted using HTTPS/TLS. Traffic over plain HTTP is automatically redirected to HTTPS. The Opyris Mobile Ready experience communicates exclusively over HTTPS.
Tenant data isolation
Each Opyris customer account (tenant) has its own isolated data schema in the database. Your employees, schedules, and reports are not stored in a shared table with other customers' data. Isolation is enforced at the database layer, not just application logic.
Secure authentication
Passwords are hashed using a secure one-way algorithm before storage. Authentication uses short-lived access tokens with refresh-token rotation. Sessions are invalidated on logout. Login attempts are rate-limited to limit brute-force exposure.
Rate limiting
API endpoints are rate-limited to protect against automated abuse. Authentication endpoints have stricter limits than general API calls.
Access control
Opyris has separate manager and employee roles with distinct permissions. Employees can only access their own information. Managers can access their tenant's data. No cross-tenant data access is permitted.
Logging and monitoring
Application events and errors are logged. Structured logs capture operational events without recording employee personal information beyond what is needed to trace the action.
Data backups
The production database is backed up on a regular schedule. Backup policies and retention periods are reviewed periodically. Restore procedures are tested as part of infrastructure changes.
Data export
Managers can export scheduling data, clock records, and payroll information at any time through the Opyris reporting tools. CSV exports are available without contacting support.
Account deletion
To delete your account and associated data, contact david@opyris.ca. Deletion requests are processed manually with confirmation. Backups containing your data are purged on their normal retention schedule after account deletion.
Subprocessors
Opyris uses third-party services for hosting infrastructure, email delivery, push notifications where enabled, and payment processing (Stripe). These processors are subject to their own security and data handling practices.
Honest about what we have and haven't done.
Opyris is a small, founder-led product. We apply sensible security practices and describe them accurately on this page. We do not claim certifications or audit reports that we have not completed.
Specifically: Opyris has not completed a SOC 2 audit at this time. If your business requires SOC 2 compliance from vendors, Opyris may not be the right fit for your current requirements. We may pursue formal certifications as the business grows.
If you have a specific security question not answered here, email david@opyris.ca directly. You will reach the founder, not a ticket queue.
Report a security concern.
If you believe you have found a security vulnerability in Opyris, please report it by email to david@opyris.ca with "Security" in the subject line. Please do not post vulnerability details publicly until we have had a reasonable opportunity to investigate and respond.
We aim to acknowledge security reports within 2 business days and to provide a status update within 7 business days.