Security

Security is built into how Opreet works. This page describes the protections you can rely on, in general terms. We do not publish detailed technical or operational information, because that would help attackers more than customers.

• You sign in with your email address and a password. Passwords must meet minimum strength rules, and we never see or store your password in readable form.
• To change your password, you must first confirm your current one.
• Each customer can reach only their own account and records.

Signing in is not enough to move money. Every payment and transfer must also be approved with your transaction PIN, which is separate from your password.

• Your PIN is stored only as a one-way hash, never in readable form.
• Repeated incorrect attempts temporarily lock PIN approvals.
• If you forget your PIN, you can reset it with a one-time code sent to your registered email address, which expires quickly.

Connections between your device and Opreet are encrypted. Customer data is held in managed infrastructure with access controls, and our providers are expected to protect it. Where data is stored: [where customer data is stored and processed: to be confirmed].

• Funds are set aside before an instruction is sent to a provider, and returned automatically if the transaction fails.
• A repeated or retried request is recognised, so you are not charged twice for the same instruction.
• You are shown the details to review before you approve, and each transaction has a reference you can quote to support.

We notify you in the web app, and by email unless you have switched security emails off, when something important changes on your account, such as a password or PIN change. If you get an alert for something you did not do, act on it straight away. We recommend keeping security emails switched on.

We work to detect and prevent fraud and misuse, and reserve the right to hold, delay or refuse a transaction, or restrict an account, where we have concerns. We do not publish how we do this, because that would help fraudsters.

• Never share your password, PIN or one-time codes. Opreet will never ask you for them, by phone, message or email.
• Use a strong password that you do not use anywhere else, and a PIN that is hard to guess.
• Sign out on shared devices, and keep your device and browser up to date.
• Check every detail before you approve a payment, and review your history regularly.
• Be careful with links and messages claiming to be from Opreet. If in doubt, type the address of the web app yourself.

If you believe you have found a security weakness in Opreet, please tell us before you tell anyone else, and give us reasonable time to fix it.

• Describe what you found and how to reproduce it, without including other people's data.
• Do not access, change or delete other customers' data, disrupt the service, or test beyond what is needed to show the issue.
• Do not publish the details until we have had a chance to respond.

We will acknowledge reports and keep you informed where we can.