Token authentication
Protected requests carry a signed access token with tenant, user and role claims. Long-lived refresh tokens can be revoked individually or invalidated across every session at once.
Security
Security controls that actually exist
This page lists the controls implemented in the OPPERIQ platform today, and states plainly which ones are not implemented yet — because an evaluation is only useful if it is accurate.
Application security
Role and designation access control
Baseline roles for employees, managers, reviewers and administrators, extended by designation-derived access for HR, finance and IT functions — so a Payroll Officer gets finance access without becoming an administrator.
80 granular permissions
Permission codes span people, organisation, security, HR, finance, procurement, payroll, attendance, leave, tasks and tracking. They are grouped into reusable sets with per-user grants and denials.
Tenant isolation
Every request resolves its tenant from the verified token, and that tenant scopes every read and write. A dedicated test suite asserts that cross-tenant access attempts fail.
Append-only audit trail
Write operations record the tenant, user, action, entity and metadata. There is no delete endpoint for audit records, and administrators can export the trail for review.
Password handling
Passwords are hashed with bcrypt and never stored or logged in plaintext. Initial credentials and reset links are delivered by email to the employee rather than passed along by an administrator, and reset links are time-limited and single-use.
Rate limiting and input validation
Authentication endpoints are throttled more aggressively than general traffic, and request bodies are validated against explicit schemas with unknown properties rejected rather than ignored.
Session and device control
Administrators can list active sessions and registered devices, force a logout, block a device, and suspend or terminate a user account.
Platform administration separation
Platform administration uses a separate authentication path. Platform staff provision and suspend tenants without being able to read tenant business data, and tenant administrators cannot reach platform routes.
Feature and licence enforcement
Disabled modules are blocked by middleware before a controller runs, and licence limits are enforced in the service layer rather than only hidden in the interface.
Infrastructure
PostgreSQL with an ORM
The primary data store is PostgreSQL accessed through Prisma, so queries are parameterised and there is no string-concatenated SQL to inject into.
Redis
Used for queue coordination and live tracking state, with eviction policies configured for predictable memory use.
Background job queues
Imports, notifications and scheduled work run on durable queues with retry and dead-letter handling, so a failed job is visible rather than lost.
S3-compatible object storage
Documents, branding assets and uploads are stored through a pluggable provider — local disk, Amazon S3, Cloudflare R2 or MinIO — with private access by default.
Containerised deployment
Services ship as containers with health checks, dependency ordering and environment-based configuration for reproducible deployments.
TLS in transit
Production deployments terminate TLS at the reverse proxy and restrict cross-origin access to known origins.
Not implemented yet
If any of these are a requirement for your security review, tell us early and we will be direct about timelines.
- Multi-factor authentication
- Not implemented today. Access control relies on password authentication plus session and device management.
- Single sign-on and SAML
- Enterprise identity provider federation is planned but not available yet.
- Database row-level security
- Tenant isolation is enforced by the application layer and verified by tests, rather than by PostgreSQL row-level security policies.
Related reading: platform architecture and how tenant isolation is enforced.
See OPPERIQ on your own operation
A 30-minute walkthrough of the modules that match how you work — attendance, fleet, payroll and reporting. No commitment.