Security you can trust.
OPNCard is built on the principle that your data belongs to you. Every architectural decision — from how we store passwords to how we serve images — is made with your privacy and safety first.
How we protect your data
End-to-End Encryption
All data in transit is protected by TLS 1.3. Passwords are never stored — only bcrypt hashes with a cost factor of 10. We never have access to your plaintext credentials.
JWT Authentication
Every API request is authenticated with a signed JSON Web Token. Tokens expire after 7 days. The signing secret is environment-injected at runtime — the server refuses to start without it.
Cloud Infrastructure
OPNCard runs on Google Cloud Run — a fully managed, serverless platform with automatic TLS, DDoS mitigation, and regional isolation. We never manage raw virtual machines.
Data Isolation
Every user can only access their own templates, cards, and orders. All write operations validate ownership against the authenticated user ID extracted from the token — never from the request body.
Rate Limiting & Brute-Force Protection
Authentication endpoints are rate-limited (5 login attempts per minute per IP, 3 registrations per minute). reCAPTCHA v3 is enforced on login, register, and password-reset flows.
Input Validation & Injection Prevention
All API inputs are validated via a strict whitelist (NestJS ValidationPipe with forbidNonWhitelisted). Every database query uses parameterised statements — no raw string interpolation. Only http/https URLs are accepted in card fields.
Email Verification
New accounts require email verification before any templates or cards can be created. Verification and password-reset tokens are cryptographically random (32-byte hex), single-use, and expire within 24 hours.
Secure Image Storage
Profile and portfolio images are stored in Supabase Storage, processed through Sharp (re-encoded to JPEG, never executed), and served over CDN. Filenames are server-generated — user-supplied names never reach the filesystem.
Our GDPR commitment
OPNCard Ltd. is registered in the European Union and processes personal data in accordance with the General Data Protection Regulation (GDPR). You have the right to access, correct, export, or delete your personal data at any time. To exercise these rights, contact us at support@opncard.eu.
Common security questions
Found a vulnerability?
We want to hear from you.
We take all security reports seriously. Reach out to support@opncard.eu and we'll respond within 24 hours.