Privacy and security
How Operacora keeps each organization's data separate, protects your keys and photos, and what location is and isn't stored.
On this page
This page explains, in plain words, how Operacora protects your organization's information. For the legal privacy policy, see operacora.com/privacy.
Each organization is kept separate#
- Every record carries its organization, and every request is checked against the organization of the person signed in. One organization can never see or change another's jobs, rooms, people, photos or settings.
- Inside an organization, ranks decide who sees what: people see the work of those below them, never their peers' private lists, and workers see only their own jobs. These rules are enforced by the server on every request, so changing a web address or a request can't get around them.
- Reports and counts include only what you are allowed to open, so a number can't reveal a job you can't see.
Photos and files are never public links#
Photos, videos and floor plans are stored in private storage. There is no public web address for any of them. Each time a picture is shown, Operacora first checks that the person signed in may see that job (or that floor), and only then sends it. A link copied out of the app doesn't work for anyone else.
Uploaded files are checked by their content, not just their name, and floor-plan drawings are checked so nothing in them can run as code.
Your keys are encrypted#
Keys for the outside services in Connections and passwords in My connections are:
- encrypted (AES-256) before they are stored, each one locked to your organization and the person who saved it;
- write-only: never shown again, never sent back to a browser, and never written to logs;
- used only on Operacora's server, when a feature needs them.
Passwords for signing in to Operacora are stored only as a protected (hashed) value, never in readable form. The sign-in cookie is used only on app.operacora.com.
Location: what is and isn't stored#
| Stored | Never stored |
|---|---|
| Which building or named outdoor area a person was in, and when: only in the mode the organization chose (while clocked in, or on site during work hours), and only after the person agreed to the notice. | Exact GPS coordinates. They are only used for a moment to work out the building or area. |
| The room, when a person chooses to scan its code. | Anything outside the mode's times and places: while clocked out, outside work hours, or away from the site areas. |
| Each agreement and each "stop sharing", with who, when, which version, and phone or web. | Location in any export or report. |
| When on-site job photos are required: one location reading taken at the moment of a job photo, kept with the photo and shown to managers. | A location history from job photos: there is one reading per photo, nothing in between. |
Location records are deleted automatically after the period the organization sets (30 days unless it chooses otherwise). Android shows a notification the whole time location is shared. See Location settings, the Location and Monitoring Notice and the Terms of Use.
Nothing is silently changed#
- Every timesheet correction keeps who made it, when, the times before and after, and the reason. That record can't be edited or deleted.
- When two people change the same job at once, the second is told and shown the latest version, instead of quietly overwriting the first.
- Deleted jobs go to Trash first; deleting for good needs a second confirmation.
- AI only ever suggests (for example, categories or draft rooms). Suggestions are labelled and a person confirms them.
Calendar links#
A calendar subscription link is private to its owner and is stored only in a form that can't be turned back into the link. It shows job numbers, rooms and short titles, never photos, notes, senders or phone numbers. Making a new link or turning it off stops the old one at once. See Calendar subscriptions.
This website#
operacora.com uses no advertising or tracking cookies and no analytics, and the docs search runs entirely in your browser. The web app uses one sign-in cookie, only on app.operacora.com.
Questions or a security concern? Write to hello@operacora.com.