Security
Last updated 15 October 2026
This page is for whoever has to approve ForOps before a team can use it. It answers the questions a security review usually asks, in plain terms, and says what we do not have yet as well as what we do. If your review needs something that is not here, write to support@forops.app and we will complete your questionnaire.
The short answers
| Where does our data live? | In the United States, with the suppliers listed below. |
|---|---|
| Is it kept apart from other customers’? | Yes, by the database itself, not only by our code. |
| Is it encrypted? | In transit, always (HTTPS, enforced by the browser). At rest, by our database and file storage providers. |
| Do you support multi-factor sign-in? | Yes — an authenticator app, and an administrator can require it for everyone. |
| Single sign-on (Microsoft, Google)? | Not yet. |
| Can we see who did what? | Yes. Administrators can read and filter the full activity log, kept 2 years. |
| Can we get our data out? | Yes, all of it, at any time, from inside the app. |
| What happens when someone leaves? | Deactivating them signs them out everywhere at once and moves their open work to someone else. |
| Is there anything to install? | No. It runs in the browser and can be added to a phone’s home screen. |
| SOC 2 or ISO 27001? | Not yet. See what we do not have. |
Signing in
- Passwords must be at least 10 characters and are refused if they appear in a public list of breached passwords. The check sends only the first five characters of a hash of the password, never the password.
- Passwords are stored as salted scrypt hashes. We cannot read them, and neither could anyone who copied the database.
- Wrong passwords from one address are slowed down, then refused for a while. An account is never locked by somebody else’s guesses: past 50 wrong attempts an hour from anywhere, every attempt on it is slowed down instead.
- Two-step verification. Anyone can add a code from an authenticator app to their sign-in, with 10 single-use recovery codes for a lost phone. An administrator can require it for the whole company: everyone without it is signed out at that moment and has to set it up before they can sign back in. A password-reset email does not get anyone past the code.
- A sign-in lasts 30 days from the last time it was used, and never more than 90 days from when it began. Every request checks that it has not been ended, so signing someone out takes effect on their very next click, not when a token happens to expire.
Who can see and do what
- Three built-in roles for your team — administrator, facility manager and technician — and any number of custom roles built from 54 individual permissions, each limited to the locations you choose. People outside the company can report a problem by scanning an asset’s QR code without an account, and see only the asset they scanned.
- Every screen and every action checks its permission on the server. Hiding a button is never the only thing stopping someone.
- 4 powers stay with administrators and cannot be given to a custom role at all, whatever the settings screen is sent: billing, managing roles, exporting all data, and reading the activity log.
- Administrators can end anyone’s sessions, send them a password reset, reset their two-step verification, or deactivate them.
Keeping each company’s data separate
Every customer’s records sit in the same database, and the database itself enforces which company a request may see: row-level security is switched on and forced for every table that holds customer data, and each request is scoped to one company before it reads anything. A bug in our application code cannot return another company’s rows, because the database will not hand them over.
The application also connects to the database under separate accounts for separate jobs. The account that handles sign-in can read and write accounts and sessions, and has no access to work orders, assets or any other operational record.
Files and photos
Photos, documents and signatures are stored privately. There are no public links to them: each time one is shown, the server checks the viewer may see it and issues a link that stops working after 15 minutes.
In the browser
- HTTPS only, and browsers are told to refuse anything else for two years.
- A strict content security policy: the only scripts that run are ones the server marked for that page load, which stops most injected-script attacks.
- The app cannot be embedded in another site, so it cannot be disguised inside a page built to trick someone into clicking.
- The camera and microphone are available to ForOps only, for scanning codes, photos and dictation. Location, payment and USB access are switched off.
The activity log
More than 280 kinds of event are recorded as they happen — sign-ins and failed sign-ins with their address, role and permission changes, invitations, deactivations, two-step changes, every change of status on a work order, deletions, data exports and more. Administrators read it under Settings → Activity and can filter it by what happened, who did it and when.
It is kept for 2 years, and the database refuses to delete an entry any sooner, whoever asks — including us. A record of who did what is only worth something if it cannot be quietly edited afterwards.
Your data
- An administrator can download everything the company has stored, as one file, at any time. Each export is itself recorded in the activity log.
- What we keep and for how long is set out in the privacy policy.
- The database can be restored to an earlier point in time within 6 hours.
- Every night an encrypted copy of the database is stored with Supabase (United States), separately from the database host.
Error reports
When something breaks we are told automatically, with personal information switched off at the source. Reports from our servers have the request body, headers, cookies and query string removed before they are sent; reports from the browser keep only the page’s path. What is left is the error and the screen it happened on.
How changes reach you
Every change goes through a pull request and must pass an automated check — type checking, over 800 unit tests and a full run of the app in a real browser — before it can be released. Production is only ever released from a specific version that passed those checks, never from whatever happens to be newest.
Suppliers
| Supplier | What for | Where |
|---|---|---|
| Vercel | Runs the application | United States |
| Neon, on Amazon Web Services | Database | United States (Oregon) |
| Supabase | Private file storage for photos, videos, voice notes and documents, and the nightly database backups, encrypted before they leave our systems | United States (West) |
| Resend | Sending invitations, password resets and notifications | United States |
| Twilio | Text-message alerts and verification codes: the phone number and the message, for companies that use text alerts | United States |
| Sentry | Error reports, with personal information removed | United States |
| Anthropic | AI features, where a customer has switched them on: the photo, document or words, and the machine names, sent with one request. Not used to train its models, under our agreement with the provider. | United States |
| Giphy | GIF search in chat: the words typed into the search box | United States |
| U.S. Census Bureau geocoder and National Weather Service | Weather at a site: the site’s address (to find its coordinates) and its coordinates (for the forecast) | United States |
| Have I Been Pwned | Breached-password check: the first five characters of the password’s SHA-1 hash only (k-anonymity), never the password or the full hash | Served worldwide |
| Stripe | Payments, once billing is switched on: the company’s name and billing details. Card details are entered on Stripe’s own page and never reach us. | United States |
Dictation uses the browser’s own speech service (for example Google’s in Chrome or Apple’s in Safari), which may send the audio to the browser’s maker; ForOps receives only the text. Push notifications go through the browser maker’s push service, encrypted so that it cannot read them. The device’s location is never requested, and photos have their location metadata removed before they are uploaded.
What we do not have yet
- A SOC 2 report or ISO 27001 certificate. We will answer your security questionnaire in full instead.
- Single sign-on with Microsoft or Google.
- An independent penetration test.
Reporting a problem
If you believe you have found a security weakness in ForOps, please write to support@forops.app before telling anyone else. We will reply, keep you informed while we fix it, and credit you if you would like.