What is stored
| Data | Why | Kept |
|---|---|---|
| The snapshot behind each report (members, seat activity dates, workflow files, run and job timings) | So every figure can be traced to what GitHub returned | With the report |
| Your GitHub login, name and primary email | Sign-in, and the report-ready email | Until you ask for deletion |
| Linked sign-in methods (GitHub, Google, GitLab or Microsoft account id, and a verified email) | Opening the same account whichever way you sign in | Until removed from Your account |
| Email sign-in codes, as keyed hashes only | Checking the code you type | Ten minutes |
| Your GitHub sign-in token, encrypted | Re-checking which organisations you own | Replaced at each sign-in |
| Platform keys (Claude Code, Cursor, OpenAI, GitLab, Azure DevOps, Atlassian, JetBrains, CircleCI, Devin), encrypted | Reading each platform, and the changes you approve there | Until disconnected |
| Single sign-on settings; the OIDC client secret encrypted | Signing your colleagues in through your provider | Until removed |
| API keys, as SHA-256 hashes only | Reading the report over MCP or REST | Until revoked |
| Every change, with who approved it, and the audit log | The record finance and security reviews ask for | With the workspace |
opsen does not read source code. The only repository contents it reads are files under .github/workflows/. Other platforms are read for seats, licences, activity dates and usage, never code or tickets.
Encryption
Secrets are stored with envelope encryption: each has its own AES-256-GCM data key, wrapped by a key-encryption key that never touches the database (AWS KMS in production). The data key is bound to what it protects (the person, or the installation and connector), so a ciphertext copied to another record does not decrypt.
GitHub installation tokens are never stored. Each is minted from the app's key when needed and expires within the hour.
Access
- A report can be opened by people GitHub says are owners of that organisation, checked with their own token at every sign-in, and by people your single sign-on gives access, as admins or viewers. Viewers cannot change anything. Anyone else gets a
404, which does not confirm the organisation is a customer. - With single sign-on required, everyone, owners included, signs in through your provider at least every twelve hours.
- Every sign-in, access change, setting and action is in the audit log, with who, when, IP address and browser.
- Share links are signed, expire after 30 days, and are revoked together from settings.
- Every state-changing request is a
POSTbehind aSameSite=Laxsession cookie.
Uninstalling
Uninstalling the app in GitHub ends opsen's access immediately: no new installation token can be minted. Reports stop refreshing and share links stop working. Disconnecting a platform in settings deletes its key at once. To have stored data deleted, email [email protected] from an owner's address; it is deleted within 30 days.