Information Security Policy

Governance

2. Security ownership and risk

Oporo assigns responsibility for operating the service, responding to incidents, controlling access, protecting secrets, reviewing suppliers, and maintaining this policy. Security measures are selected with regard to the sensitivity and volume of information, likely threats, customer requirements, available technology, and implementation cost.

Security and privacy risks are considered when services and material changes are designed. Exceptions to approved controls should be documented, risk-assessed, time-limited, assigned to an owner, and reviewed until resolved. Access and operational responsibilities must be removed or changed when a person's role changes.

Cloud platform

3. Service architecture and hosting

Oporo uses managed cloud services and a separated browser, application, database, and file-storage architecture. The customer portal and API are independently internet-accessible and communicate over HTTPS. Credentialed cross-origin access is restricted through an application allow-list. The current broad hosted-application origin rule must be narrowed to explicitly approved production origins before publication.

Named providers, current service locations, and optional services are maintained in the Sub-Processor Register. Customer-specific residency commitments apply only where stated in the applicable Order Form or DPA. Cloud providers operate the physical and environmental controls for their managed facilities and services.

Access control

4. Identity, authentication, and authorisation

• A default and fallback authorisation policy requires authenticated access unless an endpoint is explicitly designated as public.
• Federated identity tokens are validated against the configured authority, audience, issuer, lifetime, signature, and secure metadata endpoint.
• Oporo-issued JSON Web Tokens validate issuer, audience, signature, and lifetime. Access tokens normally expire after 15 minutes.
• Refresh tokens are generated using a cryptographically secure random generator, stored as SHA-256 hashes, normally expire after 30 days, and are rotated on use. Reuse of a rotated or revoked token revokes the user's active token chain.
• Browser sessions use an HTTP-only cookie with an eight-hour sliding lifetime. Production configuration must require secure transport and the SameSite setting appropriate to the deployed portal/API relationship.
• Local passwords require at least 12 characters with upper-case, lower-case, numeric, and non-alphanumeric characters. Standard local accounts are locked for 15 minutes after five failed attempts, and email confirmation is required. The current bootstrap administrator exception must be removed or formally risk-accepted before publication.
• Project access is checked against active project membership and project roles. Administrative and editing operations apply role checks in addition to authentication.
• Authentication and public contact endpoints are rate-limited per source and route to reduce automated abuse.

A configured federated identity provider can supply controls such as multifactor authentication and conditional access through the relevant organisation's identity tenant. This policy does not claim those controls are enforced for every Oporo or customer account unless the applicable deployment and customer configuration require them.

Information protection

5. Data protection and cryptography

Oporo separates relational records from uploaded documents and model content using managed database, object-storage, and controlled application-storage services. Documents and protected attachments are retrieved through authenticated application routes where implemented. Project membership and role checks restrict access to customer workspaces.

The current application serves project and asset image directories as static paths before authentication. Those paths must be moved behind project-scoped authorisation before images containing confidential or personal information are accepted. Until then, customers must treat image fields as suitable only for non-sensitive content approved for public-link access.

Network traffic is protected using HTTPS/TLS. Oporo relies on encryption-at-rest capabilities of the applicable managed cloud services and protects authentication credentials using established hashing and token-signing mechanisms. Production signing keys, database connections, storage credentials, and provider secrets must be held in protected service configuration or an approved secret store and must not be committed to source control, logs, tickets, screenshots, or documentation.

Secrets are rotated through a controlled process that identifies consumers, replaces the protected value, restarts affected services, verifies authentication and health, revokes the former credential, and records the change without recording the secret.

Application controls

6. Application and interface security

• Protected API controllers require authentication, and project-scoped operations are designed to verify active membership and role before returning or changing project information.
• Public endpoints are deliberately limited to functions such as authentication, contact submission, health reporting, and public application assets.
• Authentication and contact endpoints use fixed-window rate limits and reject excess requests with HTTP 429 responses.
• Responses set protections against MIME-type sniffing and framing, apply a strict-origin referrer policy, and disable browser camera, microphone, and geolocation features through Permissions Policy.
• Unhandled server errors return a generic response while diagnostic details are recorded through restricted operational logging.
• Upload sizes are constrained. File type, content, and malware controls must continue to be assessed according to the risks of each supported upload workflow.

Change management

7. Secure development and deployment

Changes to production branches run through controlled continuous-integration and deployment pipelines. The portal pipeline installs locked dependencies, builds, and lints the application. The API pipeline restores dependencies, builds release code, runs automated tests, creates a versioned deployment artifact, and generates a database migration bundle.

Production database migrations are applied before application deployment. The application service is restarted after deployment and an automated health check must succeed. Build and deployment credentials are supplied through protected pipeline or cloud configuration rather than embedded in application source.

Security-impacting defects and dependency vulnerabilities should be assessed according to severity and remediated in a risk-based timeframe. This policy does not represent that Oporo holds a particular secure-development certification or performs security testing at a fixed cadence unless separately confirmed in writing.

Detection

8. Logging, monitoring, and audit

Oporo records relevant authentication, application, project, workflow, and administrative events to support accountability, troubleshooting, and security investigations. Request and operation identifiers support correlation while centralised telemetry monitors application exceptions and failed dependencies.

Operational alerts cover service availability and selected application and database health indicators. Access to operational records should be limited to authorised personnel, and logs should avoid credentials and unnecessary customer content. Retention is governed by the applicable service configuration, customer agreement, privacy policy, and legal requirements.

Risk reduction

9. Vulnerability and patch management

Oporo uses supported application frameworks and managed cloud services and maintains application dependencies through the software delivery process. Reported or discovered vulnerabilities are assessed for exploitability, exposure, data sensitivity, and customer impact. Appropriate action may include configuration changes, dependency or code updates, access restriction, service suspension, or credential rotation.

Oporo does not claim a particular penetration-testing schedule, vulnerability-scanning standard, ISO 27001 certification, SOC 2 report, Cyber Essentials certification, or other independent assurance unless that evidence is separately provided in writing.

Availability

10. Backup, continuity, and recovery

Oporo uses managed cloud services, health endpoints, monitoring, operational alerts, and backup and recovery procedures appropriate to the service. Operations personnel review availability, response time, server errors, resource use, database connectivity, storage failures, and background-processing failures.

Recovery procedures require periodic restoration testing and records of the backup selected, restoration target, timing, validation, result, and owner. Formal recovery point objectives, recovery time objectives, availability commitments, and service credits apply only where approved and stated in the applicable customer agreement. Customers should retain independent exports where required by their own continuity or statutory obligations.

Response

11. Security incident management

Suspected unauthorised access, token disclosure, cross-project access, unexpected export, destructive activity, or material service compromise is treated as a security incident. Oporo's process includes recording impact and timing, reviewing service and deployment health, correlating telemetry, containing the issue, preserving relevant evidence, revoking sessions or credentials where appropriate, restoring service, and recording decisions and corrective actions.

Where an incident affects Customer Personal Data processed by Oporo, notification and cooperation are governed by the DPA. Oporo will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach and will provide available information in phases where necessary. Customer is responsible for regulatory and Data Subject notifications unless otherwise agreed.

Third parties

12. Suppliers and personnel

Oporo limits access to personnel and suppliers who require it to provide, secure, support, or administer the Services. They must be subject to appropriate confidentiality and data-protection obligations. Access should be approved, reviewed, and removed when no longer required.

Material cloud and processing suppliers are evaluated in proportion to risk and governed by contractual obligations. Current subprocessors, service providers, external integrations, processing locations, and change arrangements are described in the Sub-Processor Register and DPA. Oporo remains responsible for its contractual obligations when using suppliers.

Lifecycle

13. Retention and secure disposal

Customer information is retained according to the customer agreement, documented instructions, operational requirements, legal duties, and the retention periods in the Privacy Policy. On termination, Customer can use available export functions and request return or deletion under the DPA.

Deletion from active systems may not immediately remove information from isolated backups, logs, audit records, recipient mail systems, or records retained by law. Such information remains protected, access-restricted, and subject to the applicable expiry or legal-retention process. Storage media within managed cloud services is disposed of under the provider's controls.

Shared responsibility

14. Customer security responsibilities

• Authorise suitable administrators and users, assign least-privilege project roles, and promptly remove access that is no longer required.
• Protect accounts, credentials, endpoints, browsers, networks, identity tenants, and integrations under Customer's control and enable appropriate federated identity controls where used.
• Ensure Customer Data is lawful, accurate, necessary, and appropriately classified; avoid uploading secrets or sensitive personal data not required for the project.
• Review validation, model, specification, and AI-assisted outputs using competent professional judgement before relying on them for contractual, regulatory, engineering, or safety decisions.
• Maintain independent copies or exports required for business continuity, statutory retention, or contractual evidence.
• Notify Oporo promptly of suspected compromise, unauthorised access, vulnerabilities, or security incidents involving the Services.

Assurance

15. Evidence, exceptions, and review

Subject to confidentiality, security, and protection of other customers, Oporo may provide reasonable security information required by a customer's due diligence process. Audit rights concerning Customer Personal Data are set out in the DPA. Security-sensitive architecture, credentials, vulnerability details, and other customers' information will not be disclosed.

This policy describes current controls and governance expectations; it is not a warranty that incidents cannot occur. Statements about certifications, audit reports, testing frequency, data location, recovery objectives, or service levels apply only when expressly confirmed in current written evidence or the customer agreement.

The policy will be reviewed at least annually and after material changes to the service, risk profile, law, or security environment. Material customer-facing changes will be communicated where required by contract or law.