Security at ops.bd
This page is maintained by marketsync global ltd to answer common security and privacy questions about ops.bd. It reflects current controls, not third-party certifications.
Shared responsibility
ops.bd runs on managed cloud infrastructure. We operate the application, agent runtime, and data layer. You operate your account, connector credentials, and the workflows you author. Both sides matter — this page describes ours.
Authentication
Sign-in is email/password and Google OAuth. Sessions are managed by our authentication provider using industry-standard token rotation. Password reset uses a signed, single-use recovery link. Multi-factor authentication is on the roadmap.
Tenant isolation
Every row in the operational database is scoped to a tenant. Row-level security policies at the database enforce that a user can only read and write rows belonging to a tenant they are a member of. Role checks (owner, admin, operator) run through a security-definer function to prevent policy recursion.
Data in transit and at rest
All traffic to ops.bd is TLS 1.2+. Application data and connector credentials are encrypted at rest by the managed database provider. Secrets used by server functions are held in the managed secret store and injected per-request.
Connector credentials
Third-party keys (Firecrawl, Resend, Google Sheets, and any you configure) are stored per-tenant and read only inside server-side handlers. They are never sent to the browser and never logged. You can rotate or revoke them at any time.
AI calls and prompt safety
AI reasoning runs through the Lovable AI Gateway on Gemini models. User input passed to models is validated with strict schemas server-side. Model output is treated as untrusted — it is never executed as code and is escaped before being embedded in emails or dashboards.
Rate limiting and abuse controls
Public endpoints enforce per-origin and per-IP rate limits. Failed authentication attempts are backed off. Suspicious usage patterns trigger automatic throttling before manual review.
Logging and observability
Application logs are structured and retained for operational debugging. Logs are scrubbed of secrets and connector credentials before storage. We do not log request bodies to third-party AI providers.
Backups and recovery
The managed database is backed up continuously with point-in-time recovery. Backup restoration is tested as part of routine operational drills.
Compliance posture
ops.bd is not currently SOC 2, ISO 27001, or HIPAA certified. We do not claim to be. We build with those frameworks as a reference for internal controls. Formal certification is planned once customer demand and stage justify the audit spend.
Vulnerability disclosure
If you believe you have found a security issue, please email security@ops.bd. We will acknowledge within two business days. Please do not publicly disclose the issue before we have had a reasonable opportunity to remediate. See also our security.txt.
Contact
For procurement, DPA requests, or security questionnaires, contact legal@ops.bd.