Security

Last updated: August 2026

Honest security, three surfaces

Public Comms run on your device. If this host runs an Officer Hub or Local Portal, sign-in and API traffic use HTTPS. What is stored on the server — and what is not encrypted — depends on which surface you use.

Comms tools (on your device)

Graphics, Brand Kit, and exports stay in your browser unless you choose to upload them elsewhere
No analytics, tracking cookies, or third-party ad scripts
Member photos you add in a tool are not sent to UnionOps servers by the Comms makers

In transit (hosted surfaces)

HTTPS for every page and API call on this site
Sign-in uses secure session cookies; sign out when you finish on a shared device
Security headers (CSP, frame denial) on every response

Officer Hub (confidential casework)

Grievance, bumping, time, and attachments live on the server that operates this Hub. Access is invite-only with role checks on every API route.

Optional MFA (TOTP) for confidential modules when the operator enables it
No cross-union reads — each union's data stays isolated
Production hosts should use Postgres with row-level security, not demo memory stores
File uploads are type- and size-limited; virus scanning when the operator configures it
Hybrid backup export is protected in transit; your browser encrypts the file with a passphrase the server never sees

Local Portal (member collaboration)

Circles (Bulletin, Actions, Floor, and the rest) are separate from grievance casework. Grievance notes never appear here.

Sign-in required; each Circle checks membership before read or write
On many hosts today, Circle posts are kept in server memory only until a restart — check the banner on Portal if you see one
We do not claim Portal member posts are encrypted at rest; TLS protects traffic, not stored text
Direct messages (Sidebars) go only to people in your union roster on this host

What we do not claim

UnionOps does not promise whole-platform encryption at rest. Comms stay on-device. Hosted Hub and Portal data rely on HTTPS, access control, and operator disk or database protection. Demo setups are not a production security model.

If you operate this host

Set a unique AUTH_SECRET; turn off demo logins before real casework
Flip Postgres backends and verify with /api/health before trusting durability
Prefer Canadian hosting for labour records; follow the breach playbook in our operator docs
Report suspected vulnerabilities privately via Support — not public GitHub issues

Report a vulnerability

If you found an auth bypass, data leak, or injection issue, contact the steward privately via Support.

Privacy

Data collection and controller duties are covered on the Privacy page.

Officer Hub (confidential casework)

Grievance, bumping, time, and attachments live on the server that operates this Hub. Access is invite-only with role checks on every API route.

Optional MFA (TOTP) for confidential modules when the operator enables it

No cross-union reads — each union's data stays isolated

Production hosts should use Postgres with row-level security, not demo memory stores

File uploads are type- and size-limited; virus scanning when the operator configures it

Hybrid backup export is protected in transit; your browser encrypts the file with a passphrase the server never sees

Local Portal (member collaboration)

Circles (Bulletin, Actions, Floor, and the rest) are separate from grievance casework. Grievance notes never appear here.

Sign-in required; each Circle checks membership before read or write

On many hosts today, Circle posts are kept in server memory only until a restart — check the banner on Portal if you see one

We do not claim Portal member posts are encrypted at rest; TLS protects traffic, not stored text

Direct messages (Sidebars) go only to people in your union roster on this host

If you operate this host

Set a unique AUTH_SECRET; turn off demo logins before real casework

Flip Postgres backends and verify with /api/health before trusting durability

Prefer Canadian hosting for labour records; follow the breach playbook in our operator docs

Report suspected vulnerabilities privately via Support — not public GitHub issues