Security

Last updated: 2026-08-22

OPSYNC handles sensitive customer-record data — calls, transcripts, contact information, payment status. This page describes the controls that exist today, and separates what is built into the product from what our infrastructure providers supply. Where we are not certified against a standard, we say so rather than implying it.

Access control, in the product

Authentication is handled by Clerk. Sessions are bound to short-lived JWTs, with refresh tokens exchanged through a dedicated endpoint rather than reused indefinitely.
Seven-level role-based access control: super_admin → admin → manager → supervisor → qa_manager → agent → client. Roles are enforced server-side, not in the UI.
Every tenant-scoped query is filtered by org_id. This is enforced at the query layer across the API rather than relying on the client to ask for the right rows.

Audit and monitoring, in the product

An append-only audit trail of authentication, configuration and admin actions, written by a request interceptor rather than by individual call sites — so a new endpoint is logged by default rather than by remembering to log it.
Application errors are tracked in Sentry; API logs are aggregated by the platform.
Health endpoints for the API, database, queues and external integrations.

Compliance controls, in the product

These are the controls our regulated customers actually buy, and they are enforced before a call is placed rather than reported on afterwards:

Calling-window enforcement resolved against the consumer's timezone, derived from the account record rather than the agent's location.
Consent capture, DNC scrubbing and attempt-frequency caps applied at dial time.
Per-vertical regulatory rulesets with statutory citations — for example the ten FDCPA and Reg F rules on the collections configuration, each carrying its own citation.
Call dispositions recorded as structured outcomes, so the audit trail is queryable.

From our infrastructure providers

We configure these; we do not build them. They are listed separately so you can evaluate them as vendor capabilities.

Web tier on Vercel, API on Railway, both with platform DDoS protection.
Managed PostgreSQL with encryption at rest and TLS in transit.
Redis-backed background queues, isolated per environment.
Call recordings in object storage, served only through expiring signed URLs.
Backup schedule and retention are set at the platform level. Ask security@opsynchub.com for the current configuration rather than relying on a number on a marketing page.

What we are not

We are not SOC 2 certified. No Type I or Type II report exists. If you need one, ask about timelines rather than assuming a date.
We are not ISO 27001, HIPAA or PCI certified, and we do not claim to be. The product includes controls relevant to handling regulated data; that is not the same thing as an audited certification, and we will not blur the two.
GDPR and CCPA are handled as obligations, not certifications — data export, deletion and a signable DPA are available on request. See our DPA and Privacy Policy.

Sub-processors

A current sub-processor list is available on request from security@opsynchub.com.

Reporting a vulnerability

Email security@opsynchub.com with details. We acknowledge within one business day and credit responsible disclosure.

Production posture evolves. If you are evaluating OPSYNC for a security review, ask security@opsynchub.com for current documentation rather than relying on this page alone.