Security & Compliance
OpsPal provides enterprise-grade security designed specifically for UK leisure facilities, local authorities, and multi-site operators. Your operations platform holds sensitive data—incident reports (microsoft forms), staff records, customer information—and deserves the same level of protection as your finance systems. Built on AWS infrastructure and UK-hosted throughout, OpsPal meets the security standards expected during procurement and delivers the peace of mind you need to run your operations confidently.
1. Enterprise Access Control
Single Sign-On (SSO) & Multi-Factor Authentication (MFA)
Streamline access while strengthening security. OpsPal integrates with your existing identity providers—Microsoft Entra—so your team accesses the platform through one centralised login. No more password resets, no more juggling credentials.
Add Multi-Factor Authentication to organisations that don’t have SSO to protect sensitive areas like reporting and staff records. It’s increasingly expected by insurers and auditors, and it’s built right in.
Why this matters:
- Centralised user management through your existing IT systems
- Meet insurance and audit requirements without additional complexity
- Reduce password-related support tickets by up to 60%
- Control exactly who accesses what with role-based permissions
2. UK Data Protection & Compliance
Your Data Stays in the UK—Always
OpsPal runs entirely on AWS infrastructure housed in UK data centres across multiple London availability zones. Your operational data never leaves the United Kingdom, meeting local authority and public sector data residency requirements.
Key protections:
- UK-hosted servers: All data stored in AWS London data centres
- GDPR compliant: Full data protection compliance built into every feature
- Encryption everywhere: Data encrypted at rest and in transit using bank-level TLS/SSL certificates
- Automated backups: 24-hour snapshots stored across three UK availability zones
- Access controls: Granular permissions—from duty managers to senior leadership
- Audit trails: Complete activity logs for compliance reporting
Meets requirements for:
- Local authority procurement frameworks
- University IT security policies
- Leisure trust governance standards
- Insurance and regulatory audits
3. Infrastructure Reliability & Resilience
Built to Keep Your Operations Running
Your facility can’t afford downtime—neither can your operations platform. OpsPal is built on AWS enterprise infrastructure with multiple layers of protection and automatic failover.
How we keep you operational:
- Multi-Availability Zones: Your data is distributed across physically separate London data centres. If one goes offline, you won’t even notice.
- Automated Failover: Server issues? Our system automatically switches to backup servers without interruption.
- 24/7 Monitoring: CloudWatch and New Relic continuously monitor performance, security, and uptime.
- Horizontal Autoscaling: System automatically adds server capacity during peak usage (think summer holidays or major events).
- 99.9% Uptime SLA: We’re committed to keeping your operations accessible when you need them.
4. Security Through Design
Layered Protection From Day One
OpsPal’s security isn’t an add-on—it’s fundamental to how the platform is built. Multiple security layers protect your data at every level.
Our security architecture:
- Virtual Private Cloud (VPC): Your application runs in an isolated private network—not on shared public infrastructure
- Security Groups & Firewalls: Control exactly which traffic reaches your data at both network and server level
- Web Application Firewall (WAF): Automatically blocks common web attacks and malicious traffic before it reaches your application
- Mutual TLS Authentication: Two-way verification between your users and our servers using X.509 certificates
- Private Database Access: Your database never has a public IP address—it’s only accessible through secured application servers
- Regular Security Audits: Continuous vulnerability scanning and patch management
Additional safeguards:
- Block Public Access: S3 storage (where documents and images live) blocks all public access by default
- IAM Access Management: Strict controls over who on our team can access what—principle of least privilege
- Incident Response Plan: Documented procedures for any security events
Questions About Security?
Our team can walk you through our security architecture, compliance documentation, or integration options for your specific IT environment.
Book a Call With Our Team
We’re on hand for any questions you may have. Simply book a meeting using our booking system and we will talk you through any questions.