Company

Security & Trust

This page describes how Optima Cloud handles security contact, hosting and access. It does not disclose architecture, and it does not claim certifications we do not hold.

Security contact

Security assessments, vulnerability reports, penetration-testing enquiries and customer InfoSec reviews: security@optimacloud.com.au. Researchers may also use /.well-known/security.txt.

Responsible disclosure

Report vulnerabilities in good faith to security@optimacloud.com.au. Do not access other customers’ data, degrade the service, or publish exploit details before we have had a reasonable opportunity to respond. We investigate reports and respond to the reporter. We do not currently operate a paid bug-bounty programme.

Hosting

Optima Cloud is hosted on Microsoft Azure in Australia East (Sydney).

Data residency

Application data is stored in Australia. Email delivery and payment processing are provided by subprocessors (Google Workspace, Mailgun and Stripe) and may process limited personal information outside Australia. See Privacy.

Encryption

Connections to Optima Cloud are encrypted in transit using TLS. Production data is stored on encrypted Azure infrastructure.

Identity

Access requires a unique user account and an authenticated session. Failed sign-in attempts are limited; idle sessions expire after 8 hours and sessions have a 12-hour absolute lifetime. Authenticator-app multi-factor authentication is required for all user accounts. Single sign-on is on the product roadmap and is not a live customer option today.

Access controls

Organisation membership and role-based permission checks limit what each person can see and do. Restricted areas require authentication.

Backups and recovery

Production application data is backed up and used for operational recovery. We do not publish recovery time or recovery point objectives.

Vulnerability management

We patch and scan the platform as part of ongoing operations. We do not publish a vulnerability-management SLA.

Security incidents

Report suspected incidents to security@optimacloud.com.au. We investigate and respond to the reporter.

Privacy

Privacy, data-handling and data-subject enquiries: privacy@optimacloud.com.au. See the Privacy statement and Terms.