# ENTERPRISE SECURITY QUESTIONNAIRE _**SOURCE OF PUBLISHED PAGE** — published at https://ops-ping.com/docs/legal/security-questionnaire.md by `npm run sync:www` (LTF-595 pipeline); the published copy is regenerated from this file on every sync. Edit only here. Last updated: 2026-09-23._ --- Thank you for evaluating OpsPing. This document answers the questions we most commonly receive in vendor security assessments. Because OpsPing is in beta, several answers describe work in progress — we disclose limitations plainly so your team can make an informed risk decision. ## 1. Product Overview OpsPing is a SaaS on-call paging and alerting product for DevOps and operations teams, consisting of a React Native (Expo) mobile application and an AWS-hosted backend. Alerts are delivered via push notifications (relayed through Expo's push service), email (Amazon SES), and optional SMS/voice (Twilio). ## 2. Data Handling | Question | Answer | |---|---| | What data do you process? | Account information (name, email, credentials), channel PII (on-call phone numbers and email addresses), mobile push tokens, alert logs and operational data (schedules, escalations, acknowledgements), and IP addresses / technical logs. | | Where is data stored? | Amazon Web Services — EC2 compute with PostgreSQL on EBS volumes, United States (us-east-2). Per-customer silo deployments run dedicated instances with their own database. | | How long is data retained? | Alert logs and operational data: **90 days, then automatically and permanently purged**. Account and channel data: retained while the account is active. Deletion requests honored within 30 days. | | Is data encrypted in transit? | Yes — TLS 1.2 or higher on all connections. | | Is data encrypted at rest? | Server-side encryption is enabled by default for new deployments; the encrypted-volume migration for the existing production instance is scheduled (tracked internally). Nightly backups are `pg_dump` archives stored encrypted (SSE-AES256) in a versioned, TLS-only S3 bucket. **Channel PII (phone numbers and email addresses) is NOT encrypted at the application layer** — it is stored in plaintext in the database. Application-layer encryption for channel PII is planned for a future release. | | Is data used for advertising or sold? | No. We do not sell personal information or use it for advertising. | ## 3. Subprocessors | Service | Purpose | Location | SOC 2 Status | |---|---|---|---| | Amazon Web Services (AWS) | Hosting, compute, database (PostgreSQL on EC2/EBS), S3 (attachments and encrypted backups); Amazon SES for email | United States | SOC 2 compliant (per AWS compliance programs) | | Cloudflare | DNS (authoritative name servers). API traffic is **not** proxied through Cloudflare by default — alert ingestion never transits a third-party edge | Global anycast | SOC 2 Type II compliant (per Cloudflare trust center) | | Expo | Push notification relay | United States | SOC 2 Type II compliant — Security trust services criterion (per [expo.dev/security](https://expo.dev/security), last updated Feb 2025; report available to Enterprise/Production customers on request) | | Twilio | Optional SMS/voice delivery | United States | SOC 2 Type II compliant (per Twilio trust center) | Customers are notified at least 30 days in advance of subprocessor changes, with a 14-day objection window (see our DPA). ## 4. Security Measures - **Access control:** AWS IAM with least-privilege access; production access limited to authorized personnel. - **Encryption in transit:** TLS 1.2+. - **Encryption at rest:** EBS encryption enabled by default for new deployments; encrypted-backup storage (SSE-AES256, versioned bucket); encrypted-volume migration for the existing production instance scheduled. - **Application-layer encryption:** **Not currently applied to channel PII** — disclosed beta limitation (see Section 2). - **Penetration testing:** A structured internal security review (static analysis of the backend, 20 findings across auth, access control, and injection classes) was completed 2026-08-09; critical and high findings were remediated and regression-tested. A third-party dynamic penetration test is planned. - **Vulnerability management:** Dependency monitoring and patching on a best-effort basis during beta. ## 5. Compliance | Question | Answer | |---|---| | Do you have SOC 2? | **Not yet.** SOC 2 Type II is planned post-beta. | | Is a DPA available? | Yes — a GDPR-style Data Processing Agreement is available on request, designating OpsPing as processor and the customer as controller. | | Do you support EU data transfers? | Yes — via EU Commission Standard Contractual Clauses (2021 SCCs), Module Two (controller-to-processor), incorporated into the DPA. | | GDPR data subject requests? | Access and deletion requests are honored within 30 days of a verified request. | ## 6. Incident Response - **Breach notification:** Customers are notified of any personal data breach affecting their data within **72 hours** of OpsPing becoming aware of it. - **Status page:** A hosted status page is available. Service disruptions are also communicated directly to affected customers by email. ## 7. Business Continuity & Disaster Recovery | Question | Answer | |---|---| | Infrastructure resilience? | AWS deployment with infrastructure-as-code (OpenTofu) rebuild capability. Each customer silo is a dedicated EC2 instance with its own PostgreSQL; the main deployment is isolated the same way. | | Backups? | Nightly `pg_dump` (custom format, 14-day retention on the host) plus an **off-box encrypted copy** to a versioned, TLS-only S3 bucket (AES-256 at rest; enabled 2026-09-11). Backups are restorable into a scratch database for verification. | | RPO (data loss window) | ≤24 hours today (nightly backups). Deployments moving to managed PostgreSQL (RDS) gain point-in-time recovery with an ≤5-minute window. | | RTO (time to restore service) | Target: 45–75 minutes for a full host rebuild + restore (provision from IaC 10–20 min, restore 5–30 min, DNS + verification 10–20 min). Timed restore drills are being formalized; the first drill dates the committed number. | | Formal DR plan? | Yes — runbooks exist (`docs/deploy-silo.md` silo rebuild; `docs/break-glass.md` database intervention) and are exercised. A cross-region recovery path is planned (encrypted backup replication to a second region). | ## 8. Contact and Updates Security questions not covered here: security@ops-ping.com. This questionnaire reflects the current state of the beta product and will be updated as controls mature. Last updated: 2026-09-23.