Security and access
How we access your systems and how you remove our access.
For each task, we request only the access it requires. You can review and revoke every permission we hold.
Principles
- Your accounts, billing, domains, certificates and data remain yours.
- We never use root, owner or billing credentials.
- You create delegated roles, set their scope and can revoke them.
- Every privileged action is linked to a ticket you approved.
01Access tiers
Three access levels, granted separately.
Most work uses the first two levels. We use change-level access only during an approved change window.
| Tier | Use | When granted |
|---|---|---|
| 1: Read-only monitoring | Monitoring, inventory, assessments and health checks | When onboarding or an assessment begins |
| 2: Routine operations | Restarts, scaling within agreed limits, backup checks and log review | During onboarding, limited to listed resources |
| 3: Approved changes | Patching and changes to configuration or infrastructure | For each change ticket you approve, for a limited time |
02Controls
Our access controls.
We apply these controls to every engineer in every client environment.
Identity and credentials
- Every staff account uses multi-factor authentication.
- We keep credentials in a company password vault, never in chat, email or personal notes.
- We use only company-managed devices for client work.
- We remove an engineer’s access on their last day at the company.
Change and logging
- Every login and change is linked to a ticket.
- We retain operation logs for at least 12 months.
- Each change follows this sequence: change request, risk assessment, your approval, execution, verification and closure.
Data handling
- We deploy monitoring in the same region as your workloads.
- By default, we do not export your data from your environment.
- If we process personal information for you, we do so only on your written instructions and under a data-processing agreement.
- If we detect a suspected major incident, we notify you within 30 minutes.
03Emergency access
Emergency access is time-limited.
If an incident needs access above the agreed tier and we cannot reach your approver, we follow the emergency access process in the contract.
- 01
Use only the emergency role agreed in advance
We define its scope and log it during onboarding. It is disabled by default.
- 02
Notify you immediately
We tell you why it was used, what actions we took and who took them.
- 03
Review within 24 hours
We conduct a written review with you and remove the emergency access.
04Removing access
Removing our access is part of the contract.
- At the end of a project or service, we list every role, key and agent we used.
- Within 24 hours of the end date, we remove our access and send you written confirmation that lists each item.
- Within 30 days, we deliver the documentation, infrastructure code and monitoring configuration.
05Certifications
Claims we do not make.
OPA (Tianjin) Technology does not currently hold ISO/IEC 27001, SOC 2 or any other security certification. It is not a testing or assessment body for MLPS (Dengbao). The controls above are contractual commitments, not certified claims. We will publish any certification here only after it is issued, with its scope and certificate number.
06Vulnerability reports
Report a security issue
Report it through the contact form and select “Security vulnerability report”. Do not include exploit details that would expose third-party data. We will set up a private channel to discuss specifics.
Do not access data that is not yours, degrade the service or use social engineering. We acknowledge reports made in good faith and keep you informed.
07Questions
Questions
Can we limit your access by time or IP address?
Yes. We can use time-limited roles or source-IP conditions, and record sessions through your bastion or provider tools. We agree the details during onboarding.
Can we audit your actions?
Yes. Your provider’s audit logs record every action taken with the roles you grant. We share our ticket records in monthly reports and on request.
Will you complete our security questionnaire or sign our data-processing agreement?
Yes. We answer questionnaires factually, including when the answer is no. We sign data-processing terms when we would access personal data.
Review our access model before we speak.
Request our standard access and data-processing terms. We will send them without requiring a commitment.