OpsDuty wakes people up when things break, so it has to be dependable and it has to keep your data safe. This page explains where your data lives, how we protect it, and what you can do to secure your account.
Where your data lives
OpsDuty runs in the EU. The application, database and cache are hosted by Heroku (Salesforce) in Dublin, Ireland. Incoming connections are decrypted and routed by Hetzner in Falkenstein, Germany. Email is sent from Frankfurt, Germany, and push notifications are delivered through Google's EU infrastructure.
A few services we depend on run outside the EU:
- Stripe processes payments and only receives billing details.
- Twilio delivers SMS and phone call notifications, and runs incoming call numbers.
- Sentry receives error reports. We only attach a user ID to these reports, never names, email addresses or IP addresses.
The full list is on our subprocessors page.
Keeping organizations apart
Every piece of data in OpsDuty belongs to an organization, and every request is checked against the organization and teams the user belongs to. Members only see the teams they are part of. Owners see everything in their own organization, and nobody can see data from another organization.
Encryption
- All traffic to OpsDuty is encrypted with TLS, and browsers are told to only connect over HTTPS (HSTS).
- The database and its backups are encrypted at rest with AES-256.
- Passwords are stored as salted, one-way hashes and are never stored in plain text.
Signing in
- Single sign-on with SAML 2.0 or Google, included in the Standard plan at no extra cost. With SSO you can enforce multi-factor authentication and your own password rules through your identity provider.
- SCIM provisioning adds and removes users automatically when people join or leave your company.
- Roles (owner, member and stakeholder) control who can change settings. Stakeholders get limited access, and you can turn stakeholder accounts off for your whole organization.
- Sign-in attempts are rate limited to slow down password guessing.
Protecting the application
- Cloudflare sits in front of OpsDuty and filters malicious traffic, including denial-of-service attacks.
- The application uses CSRF protection, a strict Content Security Policy, secure cookies and CORS restrictions.
- Errors are reported to our team automatically so we can fix them quickly.
Backups and availability
- The database supports point-in-time recovery, so we can restore it to any moment within the recovery window.
- We also keep a daily backup for the last seven days and a weekly backup for the last four weeks.
- The application runs on several servers at once, so we can deploy without downtime.
- The cache and job queue run with a standby that takes over automatically if the primary fails.
Access by OpsDuty staff
Access to our infrastructure follows the principle of least privilege: only people who need it to run the service have credentials, and every account with our infrastructure providers requires two-factor authentication.
OpsDuty has no built-in feature that lets our staff sign in as your users.
Data retention and deletion
How long we keep incidents depends on your plan. The retention period for each plan is listed on our pricing page.
When you close your account, we delete all data belonging to your organization. Copies in our backups expire within five weeks. See Account deletion for how to close your account.
GDPR and our DPA
You are the data controller for the data you put into OpsDuty, and we process it on your behalf. Our Data Processing Addendum (DPA) forms part of our terms and applies automatically to every customer. If your procurement process needs a signed copy, contact us and we will send one.
Reporting a vulnerability
If you find a security issue, please email [email protected]. We will confirm we received your report, keep you updated, and credit you if you want us to. Please do not access other customers' data or disrupt the service while testing.