Security
Your data stays yours.
Operelio handles spreadsheets that contain real customer records, pipeline numbers and contact details. Every part of the platform is built around that responsibility, and your files and our database live in the UK and the EU.
Last updated November 1, 2026
Where it runs
Your files stay in the UK and the EU
Files you upload stay in the UK and the EU. That is not a preference or a best effort, it is how the platform is configured. Two things go further. Files you email in to a folder pass through Resend, our email provider in the US, on their way in. And Bridgeant's summary, described in the AI operator section below, goes to Anthropic: column names, counts, the names you give things and your own words, never your rows or cell values.
The website and the app: run on Vercel in London.
The database: runs on Neon in London.
Your files: stored in Cloudflare R2, in a bucket restricted to the European Union. R2 jurisdictions are a hard limit, not a routing hint.
Processing: runs on a worker in Amsterdam.
Some of the services we use to run Operelio are US companies. Our sign-in and payment providers receive account and billing details, never your files, and where a US-owned provider hosts our infrastructure, the service itself runs in the UK and the EU. Our sub-processor page names every one, says exactly what it receives, and gives the legal basis for each transfer.
Protection at the edge. Vercel's firewall sits in front of the application with always-on DDoS mitigation, and automated traffic that does not behave like a real browser is monitored. Verified search engine crawlers are excluded, so this never gets in the way of legitimate access.
Recovery. The database supports point-in-time restore, so we can roll it back to any moment in the previous seven days. Your files, and the details each lead arrived with, are deliberately temporary and are not archived, which is why you should download anything you need to keep.
Encryption
Encrypted in transit and at rest
Every connection to Operelio is encrypted with TLS 1.2 or higher. Plain HTTP is never served: requests are redirected to HTTPS before anything is processed.
Your files and your database records are encrypted at rest by the providers that store them. Uploaded files are scoped to your workspace and are not reachable from any other account.
CRM credentials get extra treatment. When you connect HubSpot, Salesforce or Pipedrive, the access tokens are encrypted with AES-256-GCM before they are stored, using a key held separately from the database. They are never written to logs, never shown in the product after setup, and deleted immediately when you disconnect.
API keys. Keys you create for the public API are hashed before storage, shown to you once at the moment of creation, and rate limited: each key gets 60 requests a minute, and the monthly allowance is per workspace. A key can be made read-only when you create it. It can't write anything, and through the MCP server it sees only the read tools. Keys that change trails, Do Not Contact or a CRM must be made by an admin, and stop working for those changes once the maker isn't one. A revoked key fails at once.
MCP sign-in. An AI client connects to Operelio's MCP server by signing in with your Operelio account (OAuth), or with an API key, which is held to its own workspace. Before you allow it, the sign-in page lists what the connection can do. Tools that change data are marked so your assistant asks first, and access ends when you leave a workspace.
Outgoing webhooks. Each event Operelio sends is signed with HMAC-SHA256, using that endpoint's own secret and a timestamp, so you can check it came from us. Events carry ids, statuses and reason codes only: no names, email addresses or values from a lead. Addresses must be https and public; private and local addresses are refused when added and on each send, and redirects aren't followed.
Webhook secrets. Each folder's webhook secret is shown once when it is made and stored only as a hash. A folder's Typeform secret is also shown once, and is stored encrypted, because Operelio needs it to check the signature on each Typeform response. After you rotate either one, the old one keeps working for 24 hours so your senders can switch over. No request body, lead value or secret is ever written to logs.
Billing is handled entirely by Stripe, a PCI Level 1 certified payment provider. Card details are entered directly into Stripe's forms, tokenized, and never transmitted through or stored on our servers. We receive only limited payment metadata from Stripe, such as the card type, the last four digits and the expiry date, and never your full card number or CVV.
Access
Who can reach your files
Every file, job and setting belongs to a workspace. The application checks that ownership on every request, so one account cannot reach another account's data even if it knows the identifier.
Inside a workspace, members are either admins or members. Admins manage billing, team and integrations. Members do the work. Agency client workspaces are separated the same way, so one client's data never appears inside another's.
There is no internal tool that lets our team browse customer files. Access to production systems is limited to the people who maintain them, and is used for operating the service rather than reading your data.
Sign-in is handled by Clerk, which supports social sign-in and multi-factor authentication.
Privacy
We don't monetize your data
Your spreadsheets, your CRM credentials and your processing history are yours. We will never sell, rent or share your data with advertisers or data brokers.
Your files will never be used to train machine learning models. We collect the minimum needed to run the service: your account details, the files you upload, and the settings you choose.
What we do run. We use one analytics product, PostHog, hosted in the EU and configured to store nothing on your device. It tells us which features get used and where errors happen. We don't record sessions inside the product. There are no advertising pixels, no retargeting scripts and no social media trackers anywhere on Operelio.
Full detail is in our privacy policy, written without the legalese.
AI operator
The AI sees a summary, never your data
Operelio includes Bridgeant, an assistant you can ask to clean a file or get it ready for your CRM. To plan that work it sends an AI model a summary of your file: the column headers, how full each column is, the row and column counts, and the quality issues found in the data. Your actual cell values and your rows never go to the model.
The model is Claude, provided by Anthropic. What reaches it is the summary above, the message you typed and the chat so far, the names of your files, sheets, saved workflows, trails, mappings and schemas, the list of actions Bridgeant can take, and, for a question about your leads, the counts and labels that come back, such as a source, a trail or a rep's name (or the rep's email where your CRM has no name), never a cell value. In short: column names, counts, the names you give things and your own words. When a CRM refuses a record, Bridgeant gets one of a fixed set of Operelio reasons, so none of a CRM's words reach Bridgeant's AI. Your cell values and your rows never leave your workspace, and your files are never used to train a model.
On a trail, the model is asked for suggestions in three places, each from column names or your own words and never from cells: how a new source's columns match the trail's (Map sources), which column a Scorecard rule should read, and job-title keywords from the words you typed about who you sell to. When the Reviewer is on for a trail, it gets the run's counts, column names and your instructions, never a row.
Bridgeant's AI can be switched off, or kept to advice only. Each person picks their own setting, and on Pro and Agency an admin can set it for the whole workspace. A trail's AI review is its own setting on each trail.
This is built into the code, not left to a policy. The summary is assembled by one function that can only pass through headers and counts, and a second check refuses the request if a known data field, such as rows, shows up in it.
This is verifiable in the product. Under any Bridgeant reply, open “What did Bridgeant see?” to view the exact summary sent for that turn, down to each column header and count, alongside a plain statement of what was not sent.
Compliance
Where we stand
GDPR and UK GDPR. We have a lawful basis for everything we process, set out in our privacy policy. We honor data subject rights and follow the 72-hour breach notification requirement. We are registered with the Information Commissioner's Office.
Data Protection Officer. Article 37 of the UK GDPR does not require a company like ours to appoint one, and we have not. Data protection questions go to hello@operelio.com and reach the people who run the platform directly.
CCPA and CPRA. California residents can request access to or deletion of their personal data. We do not sell personal information.
Data residency. Files you upload are stored and processed inside the UK and the EU. Files you email in to a folder pass through Resend in the US first.
Data Processing Agreement. Ours is at operelio.com/dpa. It applies automatically when you accept our Terms of Service, so there is nothing to request and nothing to sign. It incorporates the transfer terms for every sub-processor outside the UK and EEA.
We complete vendor security questionnaires. Email yours to hello@operelio.com and we will send it back completed.
Lawful basis
Who is responsible for what
When you upload a file, two lawful-processing questions apply. Whether you have a lawful basis to process the personal data in that file is yours to answer. What we are allowed to do with it is ours. This section explains the split.
Your basis to upload. In practice this is usually consent, a contractual relationship, or legitimate interest. The Operelio Terms of Service require you to warrant that you have a lawful basis for every file you upload. We do not ask you to prove it.
Our basis to process. We process your file as your data processor, on your instructions, under our Data Processing Agreement. For the Email Verifier & Finder, that processing is a quality check: we confirm whether an inbox accepts mail, using EU-based providers. If you ask Operelio to recover missing or failed addresses, it rebuilds them only from the email patterns already in your own file, never from an outside contact database, and we never sell or rent your list.
What is shared, and what never is. Two things are shared across customers, and it is worth being precise about them. When an address has already been verified anywhere on Operelio in the last 7 days, we reuse that verdict rather than re-checking it. That record holds a one-way hash of the address and the verification outcome: the status, the score, the reason and which provider produced it. No name, no company, no file, no account, and it is kept for 7 days. We also keep public facts about email domains, such as whether a domain takes mail and whether it is a throwaway one, which say nothing about a person. Everything else, your list, your columns, your uploaded send results, stays scoped to your own workspace, and your bounce history only ever tunes your own workspace's scoring.
Where Operelio does not help. Verification is not a consent check. If you upload a list you scraped from the web or bought from a source with no documented consent chain, we will verify which addresses accept mail. We cannot tell you whether you have permission to send to them. That is on you. Every paid plan includes a Do Not Contact list you can suppress against as an additional safeguard, but even that will not replace your own basis to process.
Full details on our role as your processor are in the privacy policy and the Data Processing Agreement. Email hello@operelio.com if your legal team needs to review.
Suppression
Do Not Contact list
For teams that need to honor suppression requests under CAN-SPAM, GDPR, CASL or PECR, every paid plan includes a workspace-scoped Do Not Contact list. Upload your suppression file once, with emails, phone numbers, domains or company names, and Operelio applies it by default in the CRM Formatter, and in trails and workflows when you add the Remove suppressed contacts step. Matching runs on your data inside your account, costs no credits, and never calls an outside service. Pro and Agency can add to and check the list over the API, and an AI assistant can check it on Starter and up.
You can also block by country: pick countries individually, select a whole region at once, or use the one-click Sanctioned preset, which covers the comprehensively sanctioned countries (Cuba, Iran, North Korea, Russia and Syria). The preset is a convenience, not a substitute for formal sanctions screening.
Data Health Check flags suppressed rows so you can review them, and the Email Verifier can optionally remove them from a verified list. Free plans do not include the suppression list. Starter stores up to 5,000 entries, Pro up to 25,000, and Agency up to 100,000.
Incident response
If something goes wrong
Problems reach us through user reports, the security contact below, and automated alerts we run on our own systems for operational failures. Underneath that, the providers who host the app, the database and your files run their own platform monitoring. When something is flagged we assess scope and severity, isolate the issue, and begin remediation. Affected customers are notified directly.
For confirmed breaches involving personal data we follow GDPR Articles 33 and 34: notification to the relevant authority within 72 hours where the breach is likely to put people at risk, and direct communication to the people affected where that risk is high, describing what happened, what data was involved, and what we are doing about it.
After an incident we look for the root cause rather than just the symptom, and close the gap before we consider the matter resolved.
You can check current service status any time at operelio.com/status.
Responsible disclosure
Reporting a vulnerability
If you discover a vulnerability, email security@operelio.com with details of the issue. Please do not disclose it publicly until we have had time to investigate and patch.
Our targets are to acknowledge your report within 24 hours, assess its severity within 48 hours, and begin remediation within five business days. They are targets, not guarantees. We will keep you updated until the issue is resolved, and critical vulnerabilities take priority over everything else we are working on.
Questions about security?
We are happy to walk through our practices, answer questions in writing, or complete your vendor security questionnaire.
This page describes our current security practices. No security measure is completely effective.