Security Policy

Security Overview

Opturna uses administrative, technical, and physical safeguards designed to protect user information and connected financial data. Opturna follows a data-minimization approach and uses Plaid to securely connect user accounts to supported financial institutions.

Core Security Controls

• Encryption in transit using HTTPS and TLS 1.2 or higher.
• Encryption at rest for stored application and database data using strong industry-standard encryption.
• Secure secret management for API keys, tokens, and environment variables.
• Role-based access controls so users can access only their own information and administrative access is limited to authorized personnel.
• Password hashing using a modern one-way algorithm (bcrypt).
• Application logging and monitoring for suspicious activity, failed access attempts, and operational events.
• Change-management controls for production access and deployments.
• Routine security patching and dependency maintenance.

Plaid-Specific Safeguards

• Bank login credentials are entered into Plaid Link or the financial institution authentication flow, not directly into Opturna.
• Opturna does not store online banking usernames or passwords.
• Opturna stores and uses the minimum Plaid-linked data needed to provide authorized features.
• Users can disconnect linked institutions at any time from within product settings or by contacting support.
• Access tokens and linked items are revoked when no longer needed or when a user requests disconnection or account deletion.

Access Management

Administrative access to production systems is limited by business need. Personnel are granted only the minimum access necessary to perform their duties. Access is reviewed periodically and removed promptly when no longer required.

Incident Response

If Opturna becomes aware of a security incident affecting user data, Opturna will investigate promptly, contain the issue, assess impact, rotate or revoke credentials where appropriate, and notify affected users and partners when required by law or contract.

User Responsibilities

• Maintain a strong password and keep credentials confidential.
• Use secure devices and networks when accessing the platform.
• Report suspected unauthorized access to admin@opturnatech.com immediately.

Contact