All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Document files are stored at stable, authenticated URLs that cannot be guessed or enumerated. Dropbox OAuth tokens are encrypted server-side and never transmitted to the browser.
Role-based access control is enforced at the data layer. Admins, Project Managers, and standard users have differentiated permissions enforced server-side — frontend filtering is supplementary only. Row-level security rules prevent cross-tenant data access.
Every document upload, download, view, and deletion is logged with user email, timestamp, and document ID. Every Dropbox API call writes an audit entry. Logs are immutable (append-only) and accessible to workspace admins under Admin → Audit.
The Platform runs on Base44's managed infrastructure. Backend functions execute in isolated Deno environments. No persistent server state is stored between requests. Database access requires authenticated SDK calls — no direct database connections are exposed.
If you discover a security vulnerability in Optimum's Key, please report it responsibly to security@energyoptimum.com. We will acknowledge receipt within 2 business days and aim to remediate critical issues within 14 days.
In the event of a confirmed data breach affecting personal or confidential business data, affected workspace administrators will be notified within 72 hours. Notification will include the scope of the incident, data affected, and remediation steps taken.