Your data is yours — here is exactly how we protect it

Infrastructure

• Cloudflare Workers — edge compute

  All API requests are handled by Cloudflare Workers running at the edge, close to your location. Cloudflare's network spans 300+ cities globally with 99.99% uptime SLA. Traffic is never routed through a central server.

• HTTPS everywhere, TLS 1.3

  All data in transit is encrypted with TLS 1.3. HTTP connections are permanently redirected to HTTPS. HSTS is enforced. Certificates are issued and auto-renewed by Cloudflare — no manual cert management.

• Cloudflare D1 — encrypted at rest

  User accounts, saved artifacts, and tool run history are stored in Cloudflare D1 (SQLite-compatible edge database). Data is encrypted at rest by Cloudflare. The database is not accessible from the public internet — only from authenticated Workers handlers.

• Rate limiting and DDoS protection

  All endpoints are protected by per-IP and per-tool rate limits (60 req/min global, 10 req/min per tool). Cloudflare's DDoS mitigation handles volumetric attacks at the network layer before they reach the application. Rate limit state is stored in Cloudflare KV with automatic expiry.

Authentication

Opora uses Clerk for identity management. Sign-in is via magic link only — no passwords are stored in Opora's systems. There is no password to breach.

• Magic links are single-use and expire after 10 minutes.
• Sessions are short-lived JWTs validated against Clerk's JWKS endpoint on every request — no session tokens stored in the database.
• Worker authentication uses RS256 JWT verification via the Web Crypto API — no hardcoded secrets.
• All Clerk events (user created, session created, user deleted) are verified via HMAC-SHA256 webhook signature with replay protection (±5 minute window).
• Signing out revokes the Clerk session server-side — tokens are not reusable after logout.

Data handling

Compliance

• GDPR: Opora has a published Data Processing Agreement (DPA). Users in the EU/EEA can request data export, correction, or deletion. Legitimate interests and consent bases are documented.
• CCPA: California users have rights to know, delete, and opt out of sale (no data sale occurs). The cookie banner on every page provides opt-out controls.
• Cookie consent: Analytics and marketing cookies are off by default. The consent banner persists for 12 months and can be updated at any time via the footer "Cookie preferences" link.
• CAN-SPAM: All transactional and marketing email is sent from [email protected] with unsubscribe links and CAN-SPAM-compliant footer.
• Sub-processors: A full list of sub-processors (Cloudflare, Anthropic, OpenAI, Clerk, Klaviyo, Shopify, Cohere) is published in the Data Processing Agreement.

Responsible disclosure

If you discover a security vulnerability in Opora, please report it before public disclosure. We will acknowledge your report within 2 business days, provide a timeline for the fix, and credit you (if you want) in the changelog once the issue is resolved.

Out-of-scope reports: automated scanner results without a confirmed exploit, rate-limit exhaustion without data access, and issues in third-party services (Cloudflare, Clerk, Shopify) that we cannot remediate. For those, report directly to the vendor.