Security and trust

All customer data is stored in Canada, in the Supabase (AWS ca-central-1, Montreal) region. Application servers run on Vercel. Nothing in the product requires data to leave Canada except AI requests, which are described below.

• In transit: TLS 1.2 or better everywhere, with HTTP Strict Transport Security on every response.
• At rest: AES-256 volume encryption on the managed Postgres instance and its backups.
• Secrets: API keys are stored as SHA-256 hashes; the plaintext key is shown once and never again.

Every table carries an organization id and PostgreSQL row level security. A query can only return rows for organizations the signed in user belongs to, and that check runs inside the database, not in application code. The web application only ever holds the publishable Supabase key; privileged operations run in isolated server functions.

• AI generated SQL is parsed and validated against a table allow list before it runs, then executed by a restricted database role that holds SELECT grants only, inside a read-only transaction with a statement timeout and a row cap.
• Agents can write nothing except tasks and insights, through typed tools. An admin can turn even that off.
• An admin can also remove raw uploaded files from what the AI is allowed to read.
• Every agent run keeps a transcript: each tool call, its input, a truncated output and the final answer.
• AI generated insights and tasks are labelled in the interface, and answers carry a note that they can be wrong and should be verified.
• The model id and a SHA-256 hash of the system prompt are recorded with every AI call, so a prompt change is traceable.

• Roles: owner, admin and member, enforced by database policies as well as the interface.
• Two step verification (TOTP) for any account, and an organization wide policy that requires it for everyone.
• Passwords must be at least 12 characters and are checked against known breached password lists.
• Sessions sign out automatically after 30 minutes without interaction, and a user can end every session on every device at once.

Sign in policy changes, imports, deletions, role changes, API key creation and revocation, exports and every AI write are recorded in an append only audit log with the actor, the entity and a timestamp. Owners and admins can read it in the product and export it as CSV. Audit entries are kept for 400 days.

• Export: an admin can download the whole workspace as JSON at any time, including the audit log.
• Retention: an admin can set how long operational data is kept; a weekly job deletes anything older.
• Deletion: an owner can delete a business after typing its name. Everything cascades, and a tombstone records who deleted what and when.

• Supabase (Postgres, authentication, storage and edge functions) in ca-central-1, Canada.
• Vercel (application hosting, scheduled jobs and the AI Gateway) with global edge delivery.
• Anthropic (large language models) reached through the Vercel AI Gateway. Prompts contain the business data needed to answer the question and are not used to train models.

Opsight is built by Forecight, a Canadian cybersecurity consultancy. The product controls above are mapped to SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A and ISO/IEC 42001:2023 Annex A. Independent audits of the management system are in progress; this page describes what is implemented in the product today, not a completed certification.

Write to security@forecight.com. We acknowledge reports within two business days. Please give us a reasonable window to fix an issue before publishing it. Machine readable contact details are at /.well-known/security.txt.

See also our privacy policy and terms of service.