Trust & Security

Last reviewed 21 August 2026

OpSemble holds the records a business runs on — its people, its customers, its safety documentation and its money. This page sets out how that data is protected, what we have tested, and what we have not. Where we do not yet do something, it says so plainly: a security page that only lists strengths is not much use to the person evaluating it.

Your data is separated from everyone else's

OpSemble is multi-tenant: your company's records share infrastructure with other customers'. Separation is enforced in the data layer rather than left to individual screens to remember. Every tenant-owned table carries a filter that restricts queries to the signed-in company, and that filter fails closed — if no company can be established for a request, the query returns nothing rather than everything. The small number of deliberately cross-company operations, such as our own platform administration, have to opt out of that filter explicitly and in the open.

Access control

• Roles and permissions. Access is granted by permission, per module and per action, and roles are defined by each company for itself rather than fixed by us.
• Two-factor authentication is available using standard authenticator apps.
• Single sign-on. Companies can sign in through their own identity provider using OpenID Connect — Microsoft Entra, Google Workspace or any compliant provider — and can require it, so that joiners and leavers are controlled centrally by your IT.
• Sessions are per device. Each sign-in is recorded with its device and last-used time, and any user can see their active sessions and revoke one, or sign out everywhere, from their profile.
• Confidential records. Individual projects and records can be restricted to named members, separately from module permissions.

Encryption

Connections to OpSemble are served over HTTPS, with HTTP Strict Transport Security enabled so browsers refuse to fall back. Data is stored in Microsoft Azure and inherits the storage encryption of that platform.

Above that, credentials that OpSemble holds on your behalf are encrypted at the application layer before they are written to the database, so that database access alone does not yield working credentials. That covers the connections most likely to matter: single sign-on client secrets, payment provider keys, HMRC and accounting tokens, mailbox access and refresh tokens, and two-factor secrets and recovery codes.

API keys you generate for the OpSemble API are hashed, not encrypted. We cannot show you a key again after it is created, because we do not keep a recoverable copy — if it is lost, it is revoked and replaced.

Audit trail

Actions that change records are written to an audit log that records who did what, to which record, and when. Audit entries are chained together cryptographically, so a later attempt to alter or remove an entry breaks the chain and is detectable; the chain is verified automatically on a schedule. Administrators can export the audit log for a date range for their own review or for an external auditor.

Testing and evidence

The evidence below was produced for our HM Revenue & Customs production credentials application and is available to customers and prospective customers on request.

Browser-side protections are set as response headers on every page: a content security policy that forbids OpSemble being framed by another site, no-sniff, a strict referrer policy, a restrictive permissions policy, and cross-origin isolation headers. Session cookies are HTTP-only, secure, and same-site strict.

Hosting, backups and continuity

• OpSemble runs on Microsoft Azure. The database is hosted in the UK; the application tier and uploaded file storage run in Microsoft's West Europe (EU) region. Our privacy notice sets out what this means for data transfers.
• The database supports point-in-time restore over a rolling seven-day window.
• Production and staging are separate environments with separate databases.

Sub-processors and third parties

OpSemble uses a small number of third parties to deliver the service — hosting, email delivery, payment processing, and the AI provider behind the in-product assistant. They are identified in our Data Processing Agreement, which also covers how we notify you of changes.

Your data is yours

• Export. Records can be exported from the product, and a public API is available for programmatic access.
• Subject access and erasure. Built-in tools produce a subject access export for an employee or a customer contact, and carry out erasure where you are required to, with the action recorded in the audit trail.
• Retention you control. Your administrators can set how long operational records — notifications, webhook logs, ended sessions, chat messages and stale CRM leads — are kept, per record type. Auto-deletion is off by default, every automatic deletion is written to the audit log, and records with statutory retention periods (health & safety, HR, payroll, invoicing, quality) deliberately cannot be auto-deleted.
• Deletion on leaving. Our DPA sets out what happens to your data when you stop using OpSemble.

What we do not have yet

We would rather you heard this from us than discovered it in a questionnaire.

• OpSemble is not currently certified to ISO 27001 or SOC 2. We have an internal information security policy and the testing evidence above, but neither is a substitute for an external audit, and we do not describe them as one.
• Our status page shows live service state, checked from your own browser and independently monitored from multiple regions. We do not yet publish historical uptime figures — we would rather publish nothing than a number we cannot stand behind.
• We do not operate a paid bug bounty, though we welcome good-faith reports and will credit reporters who want to be named.

Reporting a problem

If you believe you have found a vulnerability, or you are aware of an incident affecting OpSemble or its customers' data, please email security@opsemble.co.uk. We acknowledge reports within two working days. Our disclosure policy sets out what we commit to, and what counts as good-faith research.

Where an incident affects personal data, we follow our incident process: affected customers are informed, and where required we notify the Information Commissioner's Office within 72 hours of becoming aware.

Documents

Completing a security questionnaire, or need the scan evidence, our information security policy or a signed DPA? Email security@opsemble.co.uk and we will turn it around rather than stall it.