Your data, kept separate, backed up and yours to take.

Each company's workspace is kept apart

Every company's data carries its workspace, and the database itself refuses to show one workspace's rows to another.

• Row-level security is on for every workspace table in Postgres. The app connects as a database role that row-level security always applies to.
• Each request runs in a transaction that first sets the workspace; a query without one fails rather than running unscoped.
• Database triggers set a child record's workspace from its parent, so a record can't be attached to another workspace's shipment or invoice.
• An automated test calls every API route as one workspace with another's record IDs and fails if anything is revealed, changed or linked. It's generated from the list of routes, so a new route can't skip it.
• Each workspace has its own address, and sign-in sessions belong to that address alone: a session presented on another workspace is refused.

Hosted in Singapore

Optivis CMS runs on a ReadyServer virtual private server in Singapore, as one Docker Compose stack: the web app, a background worker, Postgres and Redis.

• The app listens only on the server itself; Caddy, in front of it, serves every address over HTTPS with a certificate for *.optivis.co.
• Uploaded documents are kept on the server's own storage or in private S3-compatible storage.
• Secrets for your mail server and Xero connection are stored encrypted, and passwords are stored as bcrypt hashes.

Encrypted backups, off the server

Every night the database and uploaded files are backed up, encrypted with AES-256 and copied to storage in another location. The encryption key is kept off the server.

• A restore is rehearsed every month: the newest backup is restored into a scratch database and checked.
• Backups roll over, so deleted data leaves them as old backups expire.

Optivis staff, and when they can see your data

Optivis staff can't open your workspace unless one of your administrators allows it. Access lasts 24 hours, is view only unless you also allow changes, and you can end it at any time.

• Everything support does in your workspace appears in your own audit log.
• Staff use a separate portal on admin.optivis.co with their own accounts, and every sign-in needs a code from an authenticator app.
• Staff have roles (administrator, support, read-only), and everything staff do is recorded in the staff audit log.

Signing in and sign-up

Password resets and invitations are single-use e-mailed links, and sign-up is protected against bots and abuse.

• Sign-up uses Cloudflare Turnstile, rate limits and a check for disposable e-mail addresses.
• Customer tracking links can have a PIN, which is never put in the web address; five wrong PINs lock the link for 15 minutes.
• Spreadsheet exports neutralise formulas, so a cell can't run anything when opened.

Your data stays yours

An administrator can download everything the workspace holds, at any time, as one zip: every table as JSON, the main records as CSV, and all uploaded files.

• The export is read through the same row-level security, so it can only contain your workspace's data; password hashes and stored secrets are left out.
• Cancelling a paid plan never deletes anything: the workspace moves to the free Lite plan.
• A workspace is deleted only when an administrator asks for it, 30 days after the request, and the request can be cancelled until then.