How it is built
What this product guarantees, and how each guarantee is held.
Ops Backroom is a small operation. It has none of the audits and attestations a large vendor would put in front of you, and the next section says so before anything else. What it has instead is a set of properties enforced in code and checked automatically — each one stated below at the strength its evidence actually supports, and narrowed where the evidence runs out.
First, the absences
What this page does not claim
A trust page usually opens with badges. This one opens with what is missing, because the list is short, it is checkable, and a page that leaves it out is not worth reading.
- No SOC 2 report, and no ISO 27001 certification
- Neither audit has been carried out. Nothing here should be read as implying one is under way.
- No penetration test
- None has been commissioned, so there is no report to share and no findings to summarise.
- No SSO and no SAML
- Sign-in is an emailed link to an address that has been allowed in advance. There is no identity-provider integration.
- No data processing agreement to hand you
- There is no standard DPA document today. If your business needs one, it is a conversation rather than a download.
- No uptime commitment and no status page
- The scheduled jobs are monitored by the product itself — each screen shows when its data last arrived — but nothing here is an availability guarantee.
- No customer logos and no customer count
- The software is operated for one brand today, under common ownership, and is being prepared to run for others. A page that showed logos would be showing logos it does not have.
Your data
What is stored, and what is deliberately not
Order ingestion writes down no shopper
Every order pipeline copies fields by an explicit allowlist — naming what to keep, rather than deleting what is known to be sensitive — so a field a platform adds tomorrow is left out by default instead of having to be remembered. Names, email addresses, phone numbers and shipping addresses reach no column and no stored audit payload. They do arrive in the delivery: the honest statement is that they are received and not written down, never that they are never received.
Cross-business isolation is schema, not policy
One business cannot read another’s rows because the database refuses, not because the application remembers to filter. Every tenant table carries a row-level policy scoped to the businesses you belong to. The key that bypasses those policies lives in a single server-only module, and a check that runs on every push fails if that variable is referenced anywhere else in the tree.
Two things about people that are stored, named here rather than left to be found
The platform’s own customer id is kept, stored exactly as the platform issued it. It is pseudonymous rather than anonymous — the platform that issued it can resolve it back to a person, and the privacy policy says so in those terms. It is what makes a repeat-customer figure possible at all, and it is deleted after a retention period of 24 months by a job that runs daily.
A connected support inbox stores addresses. If you route your support mail here, the address of whoever wrote to you and the message they sent are stored, because a reply has to be threaded and has to have somewhere to go. Looking a person up by their email address is not a feature of this system, and the schema itself carries the instruction that it must not be built.
Every platform connection is read-only
In full, so you can compare it against the consent screen your platform shows you. No write, publish or management scope is requested anywhere, and no code path posts, publishes, orders or deletes anything on a connected account.
- Shopify
- read_orders
- read_all_orders
- read_customers
The last of the three exists for one field — the platform’s own customer id — and the ingestion allowlist discards the rest of what it makes reachable.
- instagram_business_basic
- instagram_business_manage_insights
Profile basics and post insights. Insights are read-only; the scope name is Meta’s, not a management grant.
- TikTok
- user.info.basic
- user.info.stats
- video.list
Profile, follower counts and the list of your own videos.
Authorization is granted by the account holder and can be withdrawn from the platform at any time, at which point the stored token stops working.
One thing the product can send on your behalf is a reply to someone who has written to your support inbox. It stays off until a member of your team turns reply sending on and separately allows the kind of question it may answer, and one control pauses all of it at once. Nothing is ever posted, published or ordered on a connected platform account.
We do not sell data and do not build advertising profiles. Those two are commitments, and they are written into the privacy policy rather than enforced by anything in the code — unlike the isolation above, which is. What you can check for yourself is that this site loads no analytics, tracking or advertising script of any kind, from anyone.
Your numbers
An operations dashboard is only worth as much as its worst number
The home page states these four as rules. Here is what actually holds each of them up.
- Money is integer cents
- No floating-point value touches currency. A platform’s decimal string is parsed by string arithmetic rather than by the language’s number parser, the parser throws rather than rounding when a value carries sub-cent precision, and every money column in every migration is an integer type.
- Every figure links to its definition
- One versioned document holds every formula. The product renders it in-app beside a link on each figure, and every formula in it is readable here without an account — what stays inside the product is the notes beside each formula and the document’s change log, because those discuss one business’s own measurements. Changing a calculation changes that document first: the version is bumped, a golden fixture is updated and a written note is added. A check reads the document’s own governing sentences, and it exists because it was once possible to edit that file to say the opposite of what it means with the whole gate stack still green. Read every formula.
- Instagram and TikTok are never mixed
- Not a house style: the code that builds a screen hands each platform’s block only that platform’s rows, and the shape it builds has no field for the other’s. One exception, and it is labelled where it renders — followers are summed across platforms under the words Total audience, never de-duplicated and never called reach.
- Seeded rows are labelled inside the calculation
- Demo data is not a badge painted on afterwards. Each money figure carries a note computed from exactly the rows behind that figure, for that period — so a number drawn over a mix of seeded and real orders says so, and the note retires itself the moment every row behind it is real.
How the guarantees are held
A check that cannot fail is not a check
Everything above is a claim about code you cannot see, so what matters is whether the checks behind it could ever go quiet.
Checks have to prove they can still fail
A scan for a name reports the same clean result whether the thing is properly confined or has simply been renamed out of existence — absence reads exactly like health. So the checks here carry a companion assertion proving the thing they search for is still there to be found, and new ones are validated by applying the change that ought to break them.
A failing check names the repair that is not allowed
The cheapest way to make a check stop complaining is to weaken it, and that is usually done in good faith under time pressure. So when one goes red it says, in its own failure message, which fix is forbidden and which two are legitimate.
Some of it runs by hand, and we say which
Four gates run on every change: the test suite, the type checker, the linter and a production build. The suites that need a live database are held back from that stack on purpose, because the machine running it holds no database credentials, and they are run by hand instead. Calling all of it automated would be the easier sentence and the wrong one.
Check it yourself
The parts you do not have to take on trust
Each sample below renders frozen example data through the very components the product uses, which means this site cannot show you a screen the product does not actually build. The business and every figure in it are invented.
Anything else
Ask, and you will get a straight answer or a no
Security questionnaires, a question this page does not cover, or a vulnerability you have found — all to the same address. Where the answer is that something has not been done, that is what you will be told.