Opal holds the keys to a company’s public voice. It is built accordingly.

Two factors, and no way around them.

Signing in takes an allowlisted email address, a one-time code sent to it, and a code from an authenticator app. The one-time code alone grants nothing: it buys a short-lived pending state, and only the second factor mints a session.

• Email allowlist, one-time code, then mandatory authenticator app
• No development bypass and no password reset path to abuse
• One-time codes are hashed, short-lived and rate-limited
• Backup codes are hashed, single use
• Sign out everywhere invalidates existing sessions on their next request
• The client portal is a separate audience that cannot reach the operator app

Connected-account tokens are encrypted, and only decrypted to publish.

Every third-party credential Opal holds, social tokens, mailbox credentials, integration keys, is encrypted with AES-256-GCM before it is written. The key lives in the environment, never in the database and never in a log.

• AES-256-GCM on every stored credential
• Decryption happens at the call site, for the duration of the call
• Credential columns are never selected into a client response
• Nothing sensitive crosses into the browser: secrets stay server side
• Database access is restricted to the application, over TLS

A strict policy on every response.

The application ships a Content Security Policy with nonce-vouched scripts and no inline or eval execution in production, HSTS, and a tight list of origins it is allowed to talk to at all.

• TLS everywhere, with HSTS
• Content Security Policy with no unsafe-inline and no unsafe-eval in production
• Cross-origin isolation headers on every response
• Input validated at every boundary before it reaches the database
• Parameterised queries only, no string-built SQL

Everything privileged is written down.

Publishing, taking a post down, sending an email, touching money, changing a secret or a budget: each one appends a row with the actor, the time and what changed. The log is append-only.

• Append-only audit log, per action, per actor
• Approvals and rejections recorded with their author
• Per-channel and global kill switches, off until deliberately armed
• Scheduled jobs monitored with a heartbeat, so a silent stall is visible
• Spend budgets per agent, with a hard ceiling

No public endpoints, and no inbound webhooks for automations.

Opal has no open automation endpoints. Scheduled work runs in-process behind a signed internal token, and the few genuinely public routes, the booking page, the legal pages and this website, are read-only or rate-limited and validated.

• Every operator route requires a valid session
• No third-party automation platform in the publishing path
• Public routes are rate-limited per IP and validated at the boundary
• Dependencies watched for known vulnerabilities, with secret scanning on the repository

Disconnect, and it goes.

Disconnecting a channel deletes the stored token. Revoking Opal on the platform itself cuts access from the other side. You can ask us to delete the rest of the data we hold for you, and we will confirm when it is done.

• Disconnect in Opal deletes the credential for that channel
• Revoking on the platform stops publishing immediately
• Deletion requests answered by a person, in writing
• Connected-account data is never sold, and never shared for advertising
• Content is not used to train models