Security

Last updated: July 10, 2026

Opara connects to the tools that run your business, so protecting your data is fundamental to how the product is built. This page describes the security measures currently in place. We describe only what we actually do — we do not claim certifications we have not obtained.

Authentication

Opara supports OAuth-only sign-in through Google and Microsoft. We never ask for, receive, or store your password. Authentication is delegated to your provider, which means Opara benefits from the multi-factor and account-protection controls you already have in place there. This also reduces phishing risk, since there is no Opara-specific password to steal.

Encryption

Integration access tokens — the credentials Opara uses to act on your email, calendar, and payments — are encrypted at rest. All traffic between your browser, Opara, and the services we integrate with is encrypted in transit using TLS.

Least-Privilege Access

Opara requests the narrowest access needed to do its job:

Calendar access is read-only. Opara can read your availability to suggest times and generate booking links, but it cannot create, modify, or delete events.
Email sending is limited to Opara-originated threads. Opara sends and follows up only on conversations it started on your behalf or that you explicitly bring into Opara — it does not have free rein over your entire mailbox.
Payment access is limited to status. Opara reads invoice and payment status to draft follow-ups; it does not store full card data, which is handled by Stripe.

Human-Approval Gating

By default, every outbound action requires your explicit approval. Drafts are prepared for you to review, edit, and approve; nothing leaves your account until you click to send. The one exception is one you choose: an outreach sequence can be switched to auto-send, per sequence. Auto-send is off unless you turn it on, stops the moment a recipient replies, and is held to a daily send cap.

Per-User Data Isolation

Every request is scoped to the authenticated user’s session. Your clients, drafts, briefs, and integration data are isolated to your account, and one user cannot access another user’s data.

Data Handling

For details on what we collect, how it is used, our subprocessors, and your rights, please see our Privacy Policy. In short: we do not sell your data, and we do not use the contents of your email or calendar for advertising.

Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a security vulnerability in Opara, please report it privately to security@opara-ai.com before disclosing it publicly. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to investigate and remediate. We will not pursue legal action against researchers who act in good faith and follow this process.

Contact

For any security questions, reach us at security@opara-ai.com.