Legal

Security

Last updated 24 September 2026 · Version 2026-09-24

This page describes how OpusFunnel is secured today, including what we do not have yet. We do not hold a security certification such as SOC 2 or ISO 27001 ourselves. The main providers we host on publish their own certifications; those are theirs, not ours.

Hosting

• The database, file storage, sign-in and server functions run on Supabase, on AWS in the United States (us-west-1).
• The web app runs on Google Cloud Run in the United States (us-central1).
• Our websites and customers' published pages are delivered through Cloudflare's network, which also filters attacks.
• The full list of providers is on our sub-processor page.

Encryption

Connections to OpusFunnel use TLS. Data is encrypted at rest by our hosting providers. The PayPal credentials customers connect for partner payouts are kept in an encrypted vault.

Separation between accounts

Row-level security is switched on for every table in the database, so each account can reach only its own data. Columns holding sensitive values, such as partner payout details, are hidden from the browser. Private files, such as digital products and partner tax forms, are kept in private storage and opened through links that expire within minutes. A copy of an account's data made with Download my data is kept in private storage and sent to the owner as links that expire after 7 days.

Access control

• Account owners give each team member a role. Billing, exports, erasing a contact, texting registration and tax forms are limited to owners and admins. Downloading all of the account's data and closing the account are limited to owners.
• When agency staff work inside a client's account using "act as", we log who did it, when and from which IP address.
• Exports, erasures and bulk sends are recorded in the account.
• Access to production systems at OpusFunnel is limited to the people who need it to run the service.

Payments

Card details are entered on Stripe's pages and never reach our servers. We store only Stripe's references. Customers take payments through their own Stripe accounts.

Application security

• Passwords for OpusFunnel accounts are handled by our sign-in provider and stored hashed. Buyer passwords on customers' sites are hashed with bcrypt, and session tokens are stored only as hashes.
• Webhooks from Stripe, Telnyx, Resend and our sign-in provider are accepted only with a valid signature.
• The app sends HSTS and other security headers. Published pages do not run third-party scripts.
• AI agents drop values that look like card or social security numbers before sending prompts to AI providers.
• Texting is watched for abuse: it is paused automatically when opt-out or failure rates cross our limits.

Backups

The database is backed up regularly so we can recover from failure. Backups roll off within 14 days. Server logs are kept for 30 days. When an account is closed, its data is deleted 30 days after the closure request.

Incidents

If a security incident affects personal data we process for a customer, we tell that customer without undue delay, with what we know and what we are doing, as our Data Processing Addendum sets out. Where we are the controller, we notify the relevant supervisory authority within 72 hours where the law requires, and the people affected where there is a high risk to them.

What we do not have yet

• Two-factor sign-in for OpusFunnel accounts.
• A security certification of our own, or an independent penetration test report we can share.
• A status page.

We will update this page as that changes.

Reporting a vulnerability

If you think you have found a security problem, email support@opusfunnel.com, with "Security report" in the subject line, with the details and how to reproduce it. We will acknowledge your report, keep you updated and credit you if you wish.

Please test only against your own account, do not access or change other people's data, do not degrade the service (no denial-of-service or spam testing), and give us reasonable time to fix the problem before you disclose it. If you follow these rules in good faith, we will not take legal action against you for your research.

Our contact details for security researchers are also published at /.well-known/security.txt.

Version history: 2026-09-24, first version.