Infrastructure Security
The managed OpsPing cloud runs as a single Node.js service on one AWS EC2 instance in us-east-2 (Ohio), backed by a single DynamoDB table. Email is delivered via AWS SES. We deliberately keep the infrastructure small — fewer moving parts, fewer places for things to go wrong. Private single-tenant deployments run the same application on infrastructure you or we manage.
Data Encryption
- In transit: All communication uses TLS 1.2+, terminated by Caddy in front of the application. HTTP requests are redirected to HTTPS.
- At rest: All data stored in DynamoDB is encrypted at rest using AWS-owned KMS keys. Point-in-time recovery is enabled on the table.
- API keys: Stored as bcrypt hashes in DynamoDB. No plaintext API keys exist in our database. After initial creation display, keys cannot be retrieved — only rotated.
Network Security
- The only public-facing component is Caddy on the application host. It terminates TLS, redirects HTTP to HTTPS, sets security headers, and proxies to the Node.js service listening on localhost.
- The application talks to DynamoDB and SES over TLS to AWS service endpoints, and to push/SMS/voice providers (Expo, Twilio) over HTTPS. No third party has a network path into the host.
- SSH access is key-only — password authentication is disabled. Application-level rate limiting guards authentication and alert-ingestion endpoints.
Access Control
- IAM: The EC2 instance runs under an IAM instance role scoped to the DynamoDB table and SES sending — least privilege, no standing console credentials on the host.
- API auth: API keys (OpsPingKey / GenieKey-compatible) for programmatic access, and signed JWTs for mobile/web sessions. Both are validated on every request.
- Infrastructure access: Server changes follow a documented deploy runbook. Per-customer (single-tenant) infrastructure is provisioned with OpenTofu (
tofu/aws-silo). - Employee access: Production host access is over SSH with individual keys. As described under Zero Standing Access below, this does not grant anyone the ability to read customer alert data.
Application Security
Authentication
- Passwords are hashed with bcrypt. TOTP-based MFA with backup codes is available, and admins can reset a user's enrolled factor.
- API keys are random tokens with per-key scoping (read, write, delete, config) and optional binding to a specific team. Keys are stored only as hashes.
- JWT access tokens expire after 15 minutes by default; refresh tokens last 30 days with rotation. Password resets, blocks, and role changes invalidate all outstanding tokens immediately.
- Account recovery requires verified email. Authentication and registration endpoints are rate-limited.
Input Validation & Output Encoding
- All API inputs are validated with Zod schemas before processing. Unknown fields are stripped.
- Dynamic content rendered in the admin dashboard is escaped via React's default JSX escaping.
- API responses set
Content-Type: application/json— no content sniffing possible. - CSP headers configured on the admin dashboard and marketing site.
Dependency Management
- Dependencies are pinned with exact versions in
package-lock.json. - Automated Dependabot alerts for known CVEs. Critical patches applied within 48 hours.
- Runtime: Node.js LTS (currently 22.x). Updated within 30 days of new LTS release.
Zero Standing Access
OpsPing staff hold no standing access to your data. The system is built so that we can't read your alerts unless you explicitly let us — and when you do, everything we do is recorded in your own audit log.
Tenant Isolation
- Every organization's data is scoped to a tenant id. Cross-tenant access is denied by default — there is no code path that lets staff read another customer's alerts, teams, or users.
- The same isolation machinery guards every request; staff accounts get no bypass.
Support Access by Invitation
- When you need hands-on help, you invite support@ops-ping.com into your organization through the normal invite flow, with the least role needed for the task.
- You can revoke access at any time by deleting the user or letting the invite lapse.
- Every action support takes while invited lands in your audit log, attributed to the support account — nothing happens off the record.
Break-Glass Accountability
- Manual database intervention is a documented, exceptional runbook — never routine support.
- A point-in-time backup is taken before any manual intervention.
- Wherever possible the work itself is done through the normal audited UI (via a temporary user inside your tenant) so your audit log records it; direct item edits are a last resort and are documented with exact before/after values.
- Every intervention ends with an incident record: what was done, why, by whom, and when.
Compliance & Certifications
SOC 2
We plan to pursue SOC 2 Type II certification after beta. No independent audit has been conducted yet and no report is available. See our SOC 2 page for current status and what we can share in the meantime.
GDPR
OpsPing is GDPR compliant. All customer data is stored in AWS us-east-2 (Ohio, USA). We offer a Data Processing Agreement (DPA) for customers who need one. See our Privacy Policy for details on data handling, retention, and deletion.
Data Retention
- Alerts: retained for 90 days by default (configurable per team).
- Audit logs: retained for 1 year.
- API key usage logs: retained for 30 days.
- Account data: deleted within 30 days of account closure.
Vulnerability Disclosure
If you discover a security vulnerability in OpsPing, please report it to security@ops-ping.com. We investigate all reports and respond within 48 hours. We don't run a public bug bounty yet, but we credit researchers in our changelog (with permission).
Do not attempt to access, modify, or delete other users' data when testing. Use your own account and test alerts only.
Questions?
Contact security@ops-ping.com for security questions, DPA requests, or penetration testing coordination. We're happy to provide additional documentation for your security review.
Enterprise Security Questionnaire
Evaluating OpsPing for your organization? This section answers the questions we most commonly receive in vendor security assessments. Because OpsPing is in beta, several answers describe work in progress — we disclose limitations plainly so your team can make an informed risk decision.
Product Overview
OpsPing is a SaaS on-call paging and alerting product for DevOps and operations teams, consisting of a React Native (Expo) mobile application and an AWS-hosted backend. Alerts are delivered via push notifications (relayed through Expo's push service), email (Amazon SES), and optional SMS/voice (Twilio).
Data Handling
| Question | Answer |
|---|---|
| What data do you process? | Account information (name, email, credentials), channel PII (on-call phone numbers and email addresses), mobile push tokens, alert logs and operational data (schedules, escalations, acknowledgements), and IP addresses / technical logs. |
| Where is data stored? | Amazon Web Services (DynamoDB, single-table design), United States. |
| How long is data retained? | Alert logs and operational data: 90 days, then automatically and permanently purged. Account and channel data: retained while the account is active. Deletion requests honored within 30 days. |
| Is data encrypted in transit? | Yes — TLS 1.2 or higher on all connections. |
| Is data encrypted at rest? | At the infrastructure level, yes — DynamoDB server-side encryption with AWS-managed keys. See the disclosed application-layer limitation below. |
| Is data used for advertising or sold? | No. We do not sell personal information or use it for advertising. |
Disclosed beta limitation: channel PII (phone numbers and email addresses) is not encrypted at the application layer — it is stored in plaintext in DynamoDB, protected at rest only by DynamoDB's server-side encryption with AWS-managed keys. Application-layer encryption for channel PII is planned for a future release.
Subprocessors
We share personal data only with the subprocessors needed to operate the Service — AWS (hosting, database, and email via Amazon SES), Expo (push notification relay), and Twilio (optional SMS/voice). See the full subprocessor list for purposes, data processed, locations, and SOC 2 status. Customers are notified at least 30 days in advance of subprocessor changes, with a 14-day objection window (see our DPA).
Security Measures
- Access control: AWS IAM with least-privilege access; production access limited to authorized personnel.
- Encryption in transit: TLS 1.2+.
- Encryption at rest: DynamoDB server-side encryption (AWS-managed keys).
- Application-layer encryption: Not currently applied to channel PII — disclosed beta limitation (see Data Handling above).
- Penetration testing: No third-party penetration test results are available yet. Penetration testing is planned post-beta.
- Vulnerability management: Dependency monitoring and patching on a best-effort basis during beta.
Compliance Status
| Question | Answer |
|---|---|
| Do you have SOC 2? | Not yet. SOC 2 Type II is planned post-beta. |
| Is a DPA available? | Yes — a GDPR-style Data Processing Agreement is available, designating OpsPing as processor and the customer as controller. |
| Do you support EU data transfers? | Yes — via EU Commission Standard Contractual Clauses (2021 SCCs), Module Two (controller-to-processor), incorporated into the DPA. |
| GDPR data subject requests? | Access and deletion requests are honored within 30 days of a verified request. |
Incident Response
- Breach notification: Customers are notified of any personal data breach affecting their data within 72 hours of OpsPing becoming aware of it.
- Status page: No public status page is available yet. Service disruptions during beta are communicated directly to affected customers by email.
Business Continuity & Disaster Recovery
| Question | Answer |
|---|---|
| Infrastructure resilience? | AWS multi-Availability-Zone deployment. |
| RPO | Minimal — data is stored in DynamoDB with AWS-managed durability; no formal RPO target is committed during beta. |
| Formal DR plan? | Not yet. A documented disaster recovery plan is planned post-beta. During beta, recovery relies on AWS multi-AZ redundancy and infrastructure-as-code rebuild capability. |
Security questions not covered here: security@ops-ping.com. This questionnaire reflects the current state of the beta product and will be updated as controls mature.