Security

This is the control that matters most, so it comes first. Every Workspace lives under its own identifier inside one of four top-level stores — individuals, businesses, enterprises, and visitors for trials — and every read and write is scoped to the identifier carried in your signed session token.

The scoping is enforced on the server and again by database rules, not by hiding things in the interface. A request for another organisation's record fails at the source regardless of what the client asks for, so a modified client, a replayed request or a guessed identifier gains nothing.

Within your Workspace, role permissions are enforced the same way. An assignment is private to the people on it; what a role cannot see, it cannot request — and that includes through VO, which never exceeds the permissions of the person asking.

• Passwords are hashed with bcrypt at 12 rounds. They are never stored, logged or transmitted in readable form, and we cannot recover one for you — only reset it.
• Sessions use signed JWTs with a 7-day expiry. Where a server session cookie is used it is marked httpOnly, secure and sameSite, so page scripts cannot read it and it is not sent on cross-site requests.
• Google OAuth is available for sign-in.
• Enterprise SSO — SAML 2.0, OAuth 2.0 and OpenID Connect, tested against Okta, Microsoft Entra ID, Google Workspace, OneLogin, Auth0 and custom SAML identity providers. Available on Enterprise agreements.
• reCAPTCHA protects sign-up and sign-in against automated abuse.

The platform runs on Google Cloud Platform (Firebase) in the us-central1 region, on managed, auto-scaling infrastructure. Google's own compliance certifications for that infrastructure — including SOC 1, 2 and 3 and ISO 27001 — cover the layer we build on. They are Google's certifications, not ours; we do not currently hold an independent SOC 2 or ISO 27001 audit of our own, and we will say so on this page when that changes.

Data is encrypted in transit with TLS and at rest with AES-256, including uploaded files. All traffic is HTTPS; certificates are managed automatically.

Standard hardening headers are applied to responses: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY and a Content Security Policy.

Limits protect availability for everyone and blunt credential-stuffing and scraping. Ordinary use will not reach them.

VO additionally meters a daily token budget per seat, set by your VO tier and reset each day at midnight Pakistan Standard Time.

Uploads are stored in Google Cloud Storage, encrypted at rest, and served only to authenticated members of the owning Workspace — downloads are authorised per request, not exposed as public links. Maximum upload size and total storage depend on your package and are shown on the pricing page.

Actions inside a Workspace are written to an immutable audit trail recording who acted, what they acted on, when, and what changed. It cannot be edited or deleted from the application — including by an administrator — because a log an administrator can rewrite is not evidence of anything.

Half of any organisation's security is on the organisation's side, and we would rather say so than imply otherwise:

• Use a strong, unique password. Do not reuse one from another service.
• Remove seats when people leave. A departed employee's account is the most common way an organisation's data walks out.
• Grant the narrowest role that lets someone do their job, and review it periodically.
• Treat exports as you would any other copy of your data — once downloaded, it is outside our controls entirely.
• Tell us immediately at contact@ofivio.com if you suspect an account is compromised.

Two-factor authentication is not currently available for customer accounts. It is on the roadmap and this page will be updated when it ships. We would rather tell you that than let you assume a protection you do not have.

If we become aware of a breach affecting your data we will notify you and the relevant authority without undue delay, telling you what we know, what is affected, and what we are doing. We will not wait until we have a complete picture to tell you that something happened.

If you have found something, we want to hear about it. Write to contact@ofivio.com with the subject line Security, describing what you found and how to reproduce it.

• We aim to acknowledge within 48 hours and to keep you updated until it is resolved.
• Please give us a reasonable opportunity to fix it before disclosing it publicly.
• Please do not access, modify or exfiltrate data belonging to anyone else while investigating, and do not run tests that degrade the service for other customers.
• We will not pursue a researcher who reports in good faith and stays within those bounds.

We do not currently run a paid bug bounty. We do credit reporters who would like to be credited.