Security · Operix

Your workspace is separated from every other business

Operix runs many businesses on one system. Which workspace you can open is decided by a membership record, not by the address in your browser.

Every time a page opens a workspace, Operix checks that your account has a live membership in that exact workspace. Changing the workspace id in the address bar does not open anybody else’s books — there is no membership record to match, so the page is refused.
Inside your workspace, what each person can reach is set by their role: owner, super admin, branch manager, cashier, warehouse manager, auditor, supplier. A branch manager sees their branch.
Sensitive actions are separate from being able to open the screen. Approving credit, approving a cash refund, overriding a price at the till, approving a purchase order and seeing customer contact details are each granted on their own.
Nobody can hand out a permission they do not hold themselves, so an administrator cannot quietly promote themselves or a colleague past their own level.

Signing in

Sign-in is handled by a maintained authentication library rather than something we invented, and the settings we chose are these.

A sign-in lasts seven days and is refreshed once a day while you keep working. Signing out ends it.
Two-step sign-in with an authenticator app is available to every account. Owners and super admins are asked to turn it on, and a deployment can be set to require it before they reach any workspace screen. We are not going to claim more than that: today that requirement is enforced on the workspace, and turning it on for every account that can reach Operix’s own admin console is work we have not finished.
A password-reset link is good for sixty minutes and then stops working.
The server refuses to start in production without its own signing secret configured, and without knowing its own public address. Both are checked at boot and both stop it dead. What that check cannot see is whether the value it was given is a good one — so it is on whoever deploys Operix to set a real secret rather than leave the placeholder the sample configuration ships with.

What gets recorded

The point of a record is that somebody can read it afterwards. These are written into your own workspace’s activity, where your owners and super admins can see them.

Every successful sign-in, with the device and whether that device is new to the account.
Every export of data — a report, an inventory list, a full workspace backup — with who took it and what it covered.
Restoring a backup from an uploaded file, and every support session an Operix engineer opens.
Money and stock events an owner would want to see repeated: discounts given, orders voided, cash-drawer differences, inventory imports, new API keys.
Owners are alerted when a large or sensitive export is taken, when an account signs in from a new device, and when a backup is restored from a file. Operix does not offer a setting that turns those alerts off — though an owner who has switched off email delivery for themselves will see them in the app rather than in their inbox.

What Operix staff can and cannot see

We would rather tell you this plainly than have you discover it. Here is the honest shape of our access.

To open your workspace, an Operix engineer must start a support session. It requires a typed reason, it expires after two hours, it writes a line into your own activity saying Operix opened it, and it emails your owners at the moment it starts.
That support role is granted read permissions only, and the banner our own staff see while in your workspace says most writes are blocked — not all. Making read-only a structural guarantee on every path is work still in progress, and we will not describe it as finished.
Operix administrators can see workspace-level totals across the platform — how much a business has invoiced, how many orders and products it has — for billing and support.
An Operix administrator with support access can also search across workspaces by business name, customer name, customer email or invoice number. That is how support finds your record when you write in. It is not a per-row browse of your ledger.
A support session is recorded when it starts and when it ends. The individual screens read during it are not separately recorded.

What is encrypted, and what is not

Being specific here matters more than sounding strong.

Credentials you paste into Operix — your email password, your SMS provider key, your WhatsApp token, your payment provider secret — are encrypted before they are stored, with AES-256-GCM, under a key held outside the database. Each subsystem gets its own derived key, so one cannot open another’s.
API keys Operix issues to you are stored as a one-way hash. We show the key once, at the moment it is created, and we cannot show it again. The last four characters are kept so you can tell your keys apart.
Card numbers never reach Operix. Card payments are taken by the payment provider on their own page; we keep the provider’s reference, not the card. There is nowhere in our database a card number could be stored.
Your ordinary business records — orders, invoices, customers, stock — are not separately encrypted field by field. They are protected by the workspace separation and role rules above.

Backup and restore

A backup nobody has restored is a hope, not a backup. This is what actually runs.

A full compressed database backup runs once a day, on a schedule that catches up if the machine was off. The job refuses to run at all unless it has somewhere to write to, and it can send that copy to storage away from the machine running Operix — which is the arrangement worth having, because a backup that only ever lands beside the thing it protects is lost in the same event.
Backups older than the retention window are removed. The default window is fourteen days.
Separately, you can export your entire workspace whenever you like, without asking us. Being able to take your own data out is never restricted, whatever your plan or billing state.
Restoring from a backup FILE you upload takes a snapshot of what is there now before it changes anything, and refuses to proceed if it cannot take one — so that restore can itself be undone. Restoring from a saved version inside Operix does not yet do this, and we would rather say so than let you assume it.
A restore only puts back your master records: branches, products, customers, suppliers and their commerce settings. Sales, invoices and payments are exported for your records but are never written back automatically, so a restore cannot rewrite your books.
Restoring is blocked while an Operix support session is open. Only your own people can do it.

Getting your data out, and getting it removed

Leaving should be as possible as joining.

Export is self-service and always available to an owner or admin: your whole workspace, as a file, on demand.
Report exports hide customer contact details from anyone whose role does not include seeing them, and every export is recorded and alerted as above.
Deletion is handled by our team on your written request, not by a button in the app. Some financial records are kept for audit integrity even after an account closes — our privacy page sets out what is kept and for how long.

Your books, your customers, your money