Built for operations where trust is the product.
Tenant isolation, audit logging, role-based access, and human-approved AI — designed in from the start, and described here without marketing inflation. If it’s on the roadmap, we say roadmap.
DEFENSE IN DEPTH
Six layers between a request and your records
No single control is the story. Each layer assumes the one before it can fail — and each one is in the product today, not on a slide.
Encryption in transit & at rest
TLS on the web app and the API end to end; datastores are managed cloud services with provider-managed encryption at rest.
- TLS in transit — terminated by Vercel (web app) and Railway (API), TLS 1.2+ per provider
- Provider-managed encryption at rest (AES-256) on MongoDB Atlas + Supabase Postgres
- Passwords hashed with bcrypt + enforced strength policy
Tenant isolation by design
Every tenant’s records are partitioned by a tenant identifier, and data access is scoped to the requesting tenant on every query.
- Tenant-scoped query layer on every read and write
- Requests without a valid tenant context fail closed
- Automated tenant-isolation regression suite runs as a hard CI gate
- Row-level security enabled across the relational store as defense-in-depth
RBAC + feature permissions
Signed-token authentication with role-based permissions, so people see exactly the modules and records their role allows.
- Signed JWT sessions with 24-hour expiry
- Roles plus fine-grained module:action permissions; permission changes are audit-logged
- Paid-module access enforced server-side per tenant — and per seat for DealFlow Mobile
- Login and registration endpoints are rate-limited
Immutable audit trail
The platform records who did what: changes are attributed, timestamped, and traceable end to end.
- Every create, update, and delete API call is logged with acting user, tenant, and IP
- The audit log has no delete API — no route in the platform can remove an audit entry
- Posted accounting journals are immutable — corrections post as linked reversal entries
- Locked records (e.g. approved commissions) cannot silently change
Human-approved AI actions
AI ships inside a control plane, not as a free agent: registered agents, human approvals, and an immutable record of every run.
- Dry-run mode by default in the current preview
- Consequential output waits in a human approval queue
- Standing policy: AI never writes to accounting or trust records
Canadian data handling — PIPEDA-aligned
Designed PIPEDA-first for Canadian real estate operators: your organization stays the controller of its client data.
- Your brokerage owns its data; OpSphere processes it on your instructions
- Hosting is on US-region managed infrastructure today — disclosed plainly, not implied away
- Regulated records are treated legal-hold-first — FINTRAC-related records are designed for retention, not casual deletion
- Workflow and audit-prep support for FINTRAC/BCFSA record-keeping — not legal advice
THE ENFORCEMENT CHAIN
How isolation works — on every request
A request never reaches data on reputation. It authenticates, passes the module entitlement gate, clears role-based access control, and only then touches records scoped to its own tenant — while every stage writes to the audit log. Requests that fail any check fail closed.
ACCESS, IN PLAIN LANGUAGE
Who sees what
Role-based access control sounds abstract until you map it to the people in a brokerage. Here is how access actually divides — enforced server-side on every request, not just hidden in the UI.
Managing brokers & tenant admins
See office-wide data inside their own organization — every deal, project, and record their tenant owns — and control who else gets access.
Agents & staff
Get exactly the modules and actions their role allows — read, create, edit, and delete are granted per module, and permission changes are audit-logged.
Compliance staff
FINTRAC verification records sit behind dedicated compliance permissions — access is granted explicitly, and identification-document numbers are masked in audit logs.
Platform operator (us)
Platform administration is a separate access domain from tenant accounts, operated under least privilege — and no tenant user can ever hold platform-wide access.
SECURITY PRACTICES
The unglamorous controls, done properly
Most incidents start with basics done casually. These are the operating habits behind the platform — the ones a due-diligence review actually checks.
Security questions or a concern to report? support@oneclicksolutions.ca
Secrets stay out of the codebase
Credentials live as platform environment variables with per-credential rotation policies — never committed to the repository, never logged.
No public storage paths
Storage buckets are private, and files are served through authenticated API routes with forced attachment headers — raw storage paths are never exposed to the browser.
Least-privilege access
Database users are scoped least-privilege per environment, and service credentials stay server-side only — the browser never holds a datastore key.
Hardened transport defaults
Security headers block content-type sniffing and framing, referrer policy is set, and CORS runs a strict allowlist — never a wildcard.
Rate limiting on sensitive endpoints
Login, registration, and portal-access endpoints are rate-limited per IP to blunt credential-stuffing and brute-force attempts.
Traceable by request
Every API response carries a request ID, and audit middleware records material changes — investigations start from evidence, not guesswork.
DATA HOSTING & RESIDENCY
Where your data actually lives
OpSphere is built in BC, Canada, and production data is hosted on managed cloud infrastructure in US regions today — we tell you that plainly rather than implying otherwise. Data handling follows PIPEDA's principles regardless of region: your organization stays the controller, we process on your instructions, and cross-border hosting is disclosed here and in our Privacy Policy. Canadian-region hosting is an Enterprise/roadmap option, subject to region, subprocessor, and legal review.
Vercel
Web application & CDN
Serves the frontend from a global edge network with TLS on every request.
Railway
API & background workers
Runs the backend in a US-East region deployment with TLS termination at the edge.
Supabase (PostgreSQL)
Relational & financial data
Hosted in AWS us-east-1 with provider-managed encryption at rest and row-level security enabled.
MongoDB Atlas
Document & operational data
Managed US-region cluster with provider-managed encryption at rest (AES-256).
AI, ON A LEASH
Agents draft. Humans approve.
Every AI agent on the platform is registered, runs against typed tools, and leaves an immutable run ledger — inputs, tools called, decision trace. Consequential output waits in a human approval queue before anything changes. And by standing policy, AI never writes to trust or accounting records, moves money, or files regulatory reports.
AI agents may
Draft documents, summarize records, recommend actions, prepare queue items, and run deterministic checks.
AI agents may not
Move money, release trust funds, file FINTRAC or other regulatory reports, approve compliance exceptions, or delete regulated records.
Every run leaves
A run ID, the acting user and tenant, inputs used, tools called, a decision trace, and an audit event.
Where the program goes next
SOC 2 readiness program
Control mapping and audit preparation as an enterprise readiness gate — we do not claim SOC 2 today.
SSO / SAML (Enterprise)
Single sign-on for enterprise identity providers, scoped per engagement.
Data residency options
Residency review for Enterprise plans, subject to region, subprocessor, and legal review — we do not claim Canadian data residency today.
WHAT WE DON’T CLAIM
Due-diligence requests welcome — book a demo and bring your security questionnaire.
OpSphere provides workflow and audit-prep support for regulated real estate operations. It is not legal advice, and it does not replace your organization’s own compliance obligations, policies, or counsel.
Bring your security questionnaire.
A 30-minute demo runs on your workflows and your due-diligence checklist — tenant isolation, audit trails, and the AI approval queue, live.