Security

Your data stays yours, and every change is accounted for

The security baseline applies on every plan, including Free. Enterprise adds controls on top; it never unlocks a weaker default.

How we protect your workspace

Tenant isolation in the database
Forced PostgreSQL row-level security on every tenant table. The application connects as a role that cannot bypass it, and a CI test fails the build if any table is missing a policy.
Per-organization encryption keys
OAuth tokens, MFA secrets and sensitive fields are encrypted with your organization's own data key, wrapped by a master key kept outside the codebase.
Strong authentication
Argon2id or scrypt password hashing, 15-minute access tokens, rotating refresh tokens with reuse detection, TOTP MFA, and lockout after 10 failed attempts.
AI that cannot act alone
Models never hold credentials or call platforms. Every external action passes the action gateway with policy checks, approval, verification and audit.
Payments we never touch
No card data reaches our servers. Every SSLCommerz, Stripe and Paddle webhook is verified and matched to the invoice amount, currency and transaction ID.
Append-only audit
Every member, role, billing, security, key, AI and admin action is logged with IP and request ID. The application cannot update or delete audit rows.

Controls that apply to every workspace.

Security baseline
Area	Control
Transport	TLS 1.2+ everywhere, HSTS, Cloudflare WAF and bot protection
Data at rest	Disk encryption plus envelope encryption with per-organization data keys
Isolation	Forced RLS; tenant-scoped cache, storage, vector search, queues and logs; isolation tests in CI
Application	CSRF protection, output encoding, validated input, rate limits, security headers, upload checks with malware scanning
Secrets	No secrets in the repository, logs, browser storage or mobile code; secret scanning in CI; rotation runbook
Outbound calls	SSRF guard on customer-supplied URLs: private ranges blocked, DNS re-resolved, timeouts
API keys	Hash-only storage, scopes, expiry, metering and revocation
Dependencies	Composer, npm and Dart audits, Dependabot and container image scanning
Web sessions	Refresh token in an httpOnly, SameSite=Strict cookie; access token in memory only
Mobile	Tokens in Keychain or Keystore, encrypted offline cache wiped on sign-out, screenshots blocked on patient and payroll screens

When OG Manager support needs to look at your workspace, the session is limited and visible.

Built for the realities of selling to Bangladeshi and international customers.

Health data in the Clinic module is limited to clinic roles and excluded from AI unless you opt in
Consent registry, suppression list, quiet hours and one-click opt-out for marketing messages
Data export and deletion on request; deleted workspaces are purged after a 30-day grace period and backups age out within 35 days
AI providers are used under terms that exclude training on your data, and your provider choice is visible to you
Call recordings require a consent prompt, with configurable retention and restricted access

These are our internal service targets. A contractual SLA is available on Enterprise.

Service targets
Target	Value
API availability	99.5% monthly in year one; 99.9% after the move to managed cloud
API p95 latency	Under 400 ms for reads, under 800 ms for writes
Data freshness	Within twice your plan's sync interval
Recovery	RPO 15 minutes with continuous WAL archiving; RTO 4 hours; monthly restore drills

Report a vulnerability
Email security@ogmanager.com with steps to reproduce. Please do not access other customers' data or degrade the service while testing. We acknowledge reports within two business days.
Enterprise controls
SAML and OIDC single sign-on, SCIM provisioning, IP allowlists, enforced MFA, custom roles, retention policies and data residency on a managed cloud region.
Learn more

We will walk your team through our controls and answer your questionnaire.