Trust centre

Least privilege, by design.

What opsen reads, what it never reads, how it is stored and who can change anything.

Request a security review→Technical detail

Read-only by default

No source code

Your roles

Every change logged

KMS encryption

Fully reversible

Six guarantees, read out in turn.

What opsen reads

Billing and planSeat counts, plan, last month's billed usage

MembershipMembers, outside collaborators, invitations and their activity dates

CopilotSeat assignments and last activity

ActionsWorkflow runs and job timings

Workflow filesTo propose fixes, and nothing else under the repository

Claude CodeUsage per engineer, only if you add an Admin API key

What it never reads

Application source code

Secrets and environment variables

Issues, discussions and pull request content

Anything outside the organisations you install on

How it is protected.

Envelope encryption

Every stored token and key is encrypted with its own data key, wrapped by AWS KMS.

Short-lived access

GitHub installation tokens expire within the hour and are never stored.

Your sign-in, your roles

Owners verified with GitHub at every sign-in. Everyone else through your single sign-on, as admin or viewer.

An audit log for your SIEM

Every sign-in, access change, setting and action, with who, when and from where.

Reversible by design

Pull requests, not pushes. Reclaims and cancellations GitHub can undo.

Revocable sharing

Read-only links expire in 30 days and can all be revoked at once.

Every GitHub permission, and why.

Permission	Scope	Used for
`organization_administration`	Organization	Last month's billed Actions spend from the billing usage report
`members`	Organization	Members, outside collaborators and invitations; cancelling an invitation
`organization_copilot_seat_management`	Organization	Copilot seats and their activity; reclaiming a seat
`organization_plan`	Organization	The plan and its filled seat count
`metadata`	Repository	Listing repositories (every GitHub App has this)
`actions`	Repository	Workflow runs and job timings; disabling a dormant schedule
`contents`	Repository	Reading workflow files; committing a fix to a new branch
`pull_requests`	Repository	Opening a fix pull request
`workflows`	Repository	GitHub requires it to change any file under .github/workflows
`plan`	Account	A personal account's own billing, read with its owner's sign-in, never another person's
`emails`	Account	The verified email address of the person signing in, for sign-in and the reports they ask for

Controls.

Mapped to the SOC 2 Trust Services Criteria.

Area	What opsen does
Access control	Single sign-on over SAML 2.0 or OIDC on DNS-verified domains, enforceable for everyone. Owner rights re-verified with GitHub at every sign-in and hourly, and removed the moment GitHub reports someone left. Viewer, admin and owner roles. Multi-factor authentication through your provider.
Logging and monitoring	An append-only audit log of every sign-in, access change, setting and action, with actor, time, IP and browser. CSV and JSON export for your SIEM.
Encryption	TLS 1.2+ in transit. Every stored credential sealed with its own data key under AWS KMS. Installation tokens expire within the hour and are never stored.
Change management	opsen changes your systems only through pull requests you merge or reversible switches an owner approves. Each change records its approver and outcome.
Least privilege	Read-only GitHub permissions except the three write scopes each fix needs. Platform keys are asked for read access unless you want one-click changes.
Vendor management	Every subprocessor is listed below with its purpose and region. Customers are told before a new one is added.
Incident response	Vulnerability reports answered within one working day. Customers affected by an incident are told within 72 hours.
Data lifecycle	Uninstalling stops all access immediately. Stored data is deleted within 30 days of a request to [email protected].

Subprocessors.

The services opsen relies on to run.

Service	Purpose	Location
Railway	Application hosting and database	EU West
Amazon Web Services	Key management (KMS)	Configured region
Resend	Transactional email	United States
E2B	Sandboxed linting of fix pull requests	United States
Stripe	Billing, when you subscribe	United States

Found a vulnerability?

Email [email protected] with the subject Security. We reply within one working day and credit researchers who ask.

Built for enterprise.

Read-only by default, with the controls your security review asks for.

Open the trust centre→

Single sign-on

Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 or OIDC provider, required for everyone if you choose.

SAML 2.0OIDCVerified domains

Audit log

Every sign-in, access change, setting and action, with who, when and from where. Stream it to your SIEM.

auth.ssochange.reclaim_copilotsso.enforced

Roles and access reviews

Owners verified with GitHub at every sign-in. Admins and viewers from your provider. Export who has access.

OwnerAdminViewer

Dedicated support

A named engineer and a shared Slack or Teams channel. Urgent issues answered within the hour.

Named engineerShared channel1-hour urgent

Stop paying for what nobody uses.

Start free audit→Contact sales

opsen re-audits every week and keeps taking it out. The audit is free.