HomeSecurity
Your operating data is your business
Your clients, your contracts, your routes and your proofs of service describe your revenue. Here is precisely where that data lives, how it is protected, and what would happen in a failure — no vague reassurances.
Hosted in Quebec, governed by Canadian law
OpsNode is self-hosted on infrastructure located in Quebec. Your data never transits through an American cloud and falls under no foreign jurisdiction. No third-party analytics or advertising service is loaded — not in the application, and not on this site.
The platform is built for Quebec's Law 25: anonymization of personal data, right to be forgotten with an explicit archiving workflow, export of personal information on request, and an audit trail that records who accessed what.
Verifiable, not declarative
Everything below is in production today. Nothing planned, nothing aspirational.
Encryption in transit
TLS 1.3 negotiated by default; TLS 1.0 and 1.1 refused. HSTS with preload across all domains.
Verifiable from any browserPasswords
Argon2id hashing exclusively — no bcrypt, no SHA. Rate limiting per account and per address at sign-in.
The OWASP-recommended standardNetwork isolation
Each service (database, cache, storage, monitoring) lives in its own isolated container. A single entry point is exposed to the Internet; the database is never reachable from outside.
Active firewall between servicesContinuous replication
A hot-standby PostgreSQL replica receives every write as it happens. If the primary server fails, the copy is already current.
Streaming replication, verified in productionOff-site backups
Two daily backups, one replicated every evening to a physically separate location. Restores are tested — a backup that has never been restored is not a backup.
Kept at least 90 days after any deletionContinuous monitoring
Server, database and application metrics watched around the clock, with alerts. Every critical alert has a documented response procedure.
Application errors captured and trackedA readable audit trail
Every sensitive action is logged in plain language — names and changes, not technical identifiers. Who, what, when, from where.
Available to the account ownerZero-interruption migrations
Database changes are additive first: new structures are added, observed in production, and only then are the old ones removed. No maintenance windows.
60 documented architecture decisions · 646 automated testsThe limits, stated plainly
OpsNode holds no formal certification such as SOC 2 or ISO 27001 today — those are external audit processes we will undertake when the size of the customer base justifies them. Two-factor authentication is on the roadmap; it is not yet available. If your organization requires either one now, tell us: requests like that are what set our priorities.
Specific questions? Ask someone who can actually answer.
Architecture, data residency, recovery plan: you will talk to someone who operates the infrastructure, not a sales script.
Write to the team