Trust & Security
Trust & Security
At OPCX Solutions, trust is earned through transparency, responsible data handling and practical security controls.
Whether we’re providing consultancy services, implementing support technology, or delivering software products, we aim to protect customer data, respect privacy, and be clear about how information is processed.
Security First
We use modern cloud platforms and industry-standard security practices to help protect customer information.
Our approach includes:
- Encryption in transit and at rest.
- Access controls based on least-privilege principles.
- Tenant segregation where customer data is stored within shared platforms.
- Regular review of suppliers and service providers.
- Secure handling of credentials, API keys and sensitive information.
Continuous Security Monitoring
OPCX Solutions uses Aikido Security to continuously monitor the security of our software applications, source code and cloud infrastructure.
Monitoring includes application security testing, dependency vulnerabilities, exposed secrets, cloud configuration and external application security.
Findings are reviewed and remediated as part of our development process.
Our latest independently generated security report can be requested below.
Our Security Journey
OPCX Solutions is not currently certified to Cyber Essentials Plus or ISO 27001. We are working towards recognised security standards and, in the meantime, aim to demonstrate our security approach transparently through independently monitored technical controls and security evidence.
Technology Providers & Subprocessors
OPCX Solutions uses established technology providers to deliver and secure our services. The providers involved may vary depending on the service being provided.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and backend infrastructure |
| Vercel | Application hosting and delivery |
| Microsoft Azure / Azure OpenAI | Cloud and AI processing services |
| Anthropic | AI processing for selected functionality. Use of Anthropic can be disabled for an individual customer account on request. |
| Aikido Security | Application and infrastructure security monitoring |
Further information about the subprocessors applicable to a particular OPCX service is available on request.
Privacy by Design
We design services and solutions to minimise unnecessary exposure to personal information.
Where possible, we:
- Limit the personal data processed.
- Redact or anonymise information before analysis.
- Restrict access to authorised users only.
- Provide clear retention and deletion processes.
We aim to collect and process only the data required to deliver the agreed service.
Responsible Use of AI
OPCX Solutions uses AI to support analysis, automation and operational insight. We believe AI should assist human decision-making, not replace it.
Our approach includes:
- Maintaining transparency about where AI is used.
- Using commercial AI services that do not use customer content for model training.
- Applying controls to minimise personal information being included in AI processing.
- Ensuring customers remain responsible for reviewing and validating decisions based on AI-generated outputs.
Data Ownership
Customers retain ownership of their data. OPCX Solutions does not acquire ownership rights over customer information, documentation, support tickets, reports or business data provided as part of our services.
Enterprise Readiness
For customers with additional governance, compliance or procurement requirements, OPCX can provide supporting documentation including NDAs, DPAs, data processing and security information, hosting and sub-processor information, AI processing information and independent security monitoring reports.
We are happy to work with customer security, legal, procurement and compliance teams to support reasonable due diligence requirements.
Insurance & Compliance
OPCX Solutions:
- Is registered with the UK Information Commissioner’s Office (ICO).
- Holds Professional Indemnity Insurance.
- Holds Public Liability Insurance.
- Holds Cyber Insurance.
- Operates in accordance with applicable UK data protection requirements.
Questions?
We believe trust comes from open and honest conversations.
If you have questions regarding security, privacy, AI usage, data processing or supplier management, please contact: contact@opcx.solutions
Support Insights Analysis
Support Insights Analysis has been designed with privacy and security in mind. Personal information is redacted before storage and AI analysis wherever possible, customer data is logically segregated between organisations, access is restricted to authorised users, and data is encrypted in transit and at rest. AI-generated insights focus on operational trends, recurring issues and improvement opportunities rather than individual customers. Customer content submitted through commercial AI services is not used to train AI models.
Additional technical documentation, including hosting locations, data flows, subprocessors and security controls, is available upon request.