Short and honest: how Operlio protects company workspaces used by field crews. For data practices, see the Privacy Policy.
Signed session tokens after password authentication. Passwords are hashed (bcrypt). Sessions are stored in HttpOnly cookies and expire on a fixed lifetime.
Each company has its own workspace. API and sync paths scope jobs, customers, photos, invoices, and team data to the authenticated user’s company.
Sensitive actions — registration, login, invites, payments, workspace writes, photo uploads, and exports — can be recorded with actor and timestamp for accountability.
Production traffic is served over HTTPS/TLS so credentials, job details, and photos are encrypted in transit between browsers and Operlio.
Job proof photos are stored as files associated with the company workspace (not stuffed into browser localStorage in commercial mode), with access gated by authenticated company context.
Role-based permissions (owner, manager, crew), invite-based onboarding, and quality gates for required before/after photos reduce accidental data exposure and incomplete work.
Security or privacy inquiries: privacy@operlio.io. We do not claim SOC 2 or ISO certification on this page unless independently attested — ask us for the current status.