Where your data lives
Oprex runs on infrastructure operated by PT Kinetikum Indo Solusi. Application data — requirements, tests, releases, bugs, tickets, notes, and memory — is stored in PostgreSQL, with encryption in transit (TLS) on every public endpoint. Oprex does not host your source code; it links to the repository you already run on GitLab or GitHub.
Everything in the lifecycle is reachable through the API, so an export is always possible without asking us for one.
Who can read it
Tenant isolation
Every record carries a tenant. Cross-tenant reads are not a permission you can be granted — the queries are scoped before authorisation is even considered.
Per-project access
Membership decides which projects you see. The rule is defined once and applied to lists, single-record reads, and aggregate counts alike, so a list and a detail page cannot disagree.
Confidential groups
A confidential group never appears on a public surface and forces its repositories private, regardless of later settings.
Credentials and keys
- API keys are stored as SHA-256 hashes. We cannot show you a key again after creation because we do not have it.
- Keys carry scopes; write methods are refused at the authentication layer for read-only keys, not by per-route convention.
- Keys can be bound to a single group or project, disabled, or deleted — and every key records when it was last used.
- Authentication is single sign-on; Oprex never sees or stores your password.
AI and your data
This is the question developers ask first, so the answer is blunt:
- Your content is not used to train models. Not ours, not a provider's.
- You choose the provider. AI features are configured per tenant — bring your own OpenAI-compatible or Gemini-compatible endpoint and key, and inference happens against the provider you nominated.
- Memory is explicit. Nothing is silently added to an AI context. Memory documents are included only where you attach them, which is why the boundary is auditable rather than emergent.
- Agents inherit your permissions. Connecting an MCP client never widens what is visible; the key acts as the person who created it.
Availability and continuity
Live service status is published at status.oprex.id. Databases are backed up on a scheduled basis and restores are exercised rather than assumed.
Oprex is in beta. We would rather you know that from this page than discover it from an incident. Where a guarantee does not exist yet, it is not written here.
Certifications — where we actually are
We hold no third-party security certification today, and we will not imply otherwise. What exists is a documented architecture, enforced tenant and project isolation, hashed credentials, scoped keys, and an audit trail on sensitive operations.
If your procurement process requires a formal attestation — SOC 2, ISO 27001, or an Indonesian PDP compliance statement — talk to us about timelines before you commit. We would rather tell you what we can support this quarter than promise a certificate we are still working towards.
Reporting a vulnerability
Report it through the support portal marked as a security issue. Please do not post it publicly first. We confirm receipt, keep you updated, and credit you if you want to be credited.