Preparing Opera AI
Loading your workspace…
Preparing Opera AI
Loading your workspace…
Explore how Opera AI is designed with privacy, tenant isolation, audit logging, and operational controls aligned to common legal and security frameworks.
Our controls are designed to support global data-protection laws - wherever your data subjects are.
Scope: Controller & processor obligations
We structure our controller and processor activities, lawful bases, sub-processor agreements, and data-subject support to help align with the GDPR and UK GDPR where they apply.
Scope: Notice, opt-out, service-provider role
We provide notice of data practices and support consumer rights such as access, deletion, and opt-out, in line with the CCPA/CPRA service-provider model.
Multi-tenant Row-Level Security, encrypted secrets, and continuous test gates. These practices are inspired by industry frameworks - we are not ISO/SOC certified.
Tenant isolation is enforced with Postgres Row-Level Security on tenant-scoped tables, and the application is designed to run as a non-privileged database role (operaai_app) without superuser or BYPASSRLS privileges. We are not ISO-certified; these controls are inspired by the standard.
We apply data minimisation, encrypted secrets, and PII-handling practices inspired by privacy management standards. Right-to-erasure is supported through configurable retention and deletion workflows. Not a certification.
If an auditor or statutory inspector evaluates your Opera AI workspace, the available evidence includes static analysis, database isolation checks, and runtime role verification scripts (scripts/audit-*.ts and scripts/verify-rls.ts) that help demonstrate multi-tenant isolation and non-superuser execution.
Checks that operaai_app cannot bypass RLS or read across tenant boundaries.
Webhook and internal calls authenticate via SHA-256 HMAC signatures - no plaintext secrets in headers.
Scope: Consent, notice, breach, grievance
We capture explicit consent, provide notice, and aim to meet breach-notification and grievance-redressal expectations under India's DPDP Act, 2023.
Scope: LGPD, PIPEDA, APPI and similar
Where other regional privacy laws apply based on where data subjects are located, we aim to align our practices with their core principles.
Scope: No card PAN stored on our servers
We follow a cash-first payment model and do not store raw card PAN data on our application servers. This is a product practice, not a PCI-DSS certification.
Scope: Material change traceability
Material changes across financial and ledger tables are recorded in audit logs to support operational traceability and statutory recordkeeping where applicable.
Tenant data is isolated at the database layer, and file-storage access is gated to prevent cross-tenant reads. These practices are inspired by the standards; we are not certified.
We maintain a typed TypeScript codebase with a continuous test suite and lint gates as an internal engineering practice. This is not an ISO 9001 certification.
Opera AI runs on managed cloud infrastructure with health monitoring and scheduled jobs. We do not guarantee a specific uptime SLA; availability depends on the underlying providers.
We follow a cash-first payment model (no raw card PAN stored on our servers) and record immutable audit logs of material changes. This is a product practice, not a SOC 2 or PCI-DSS certification.
Opera AI does not use workspace data to train its own models; third-party model processing is governed by provider terms and BYOK settings.