Job photos and customer records deserve the same care as the work on site.
Before you move proof-of-work off text threads, you want to know where files live and who can open them. Here is how Opeo is built — plain language, no security theatre.
Full legal details in our Privacy PolicyWhat runs under the hood
Photos on Cloudflare R2, data in managed Postgres (Supabase), API at the edge — not a server in a closet.
Cloudflare R2 & Workers
Job photos and media live on Cloudflare R2. The API runs on Cloudflare Workers at the edge — HTTPS everywhere, fast delivery for homeowners checking their link.
Supabase (Postgres)
Customers, jobs, timelines, and team settings sit in managed Postgres. Sign-in goes through Supabase Auth — we do not store passwords in application code.
Row-level security
Database policies tie data to your account. Another shop on Opeo cannot query your jobs, CRM, or media. Team members only access workspaces they belong to.
Lemon Squeezy
Card numbers never touch Opeo. Checkout and billing run through Lemon Squeezy; we receive subscription status and plan limits only.
How we think about your data
Three rules we do not break — because disputes and repeat business depend on proof you can stand behind.
- 1
You own your job history
Customer records, job photos, and timeline updates belong to your business. Download high-res media on paid plans. Contact us if you need account closure or export help.
- 2
Homeowners get a link, not your back office
Clients open a public job page with a unique URL. They see progress photos and status — not your full customer list, pricing, or internal notes.
- 3
Audit trail on higher plans
Pro and Scale plans include work logs — who changed a job, uploaded media, or updated status. Useful when multiple techs touch the same project.
Operating in Europe?
We support GDPR-style rights: access, correction, deletion, and portability where applicable. Subprocessors, cookies, and retention are documented in our Privacy Policy — including Cloudflare, Supabase, Lemon Squeezy, Resend, and Sentry.
Common security questions
Where are my job photos stored?
On Cloudflare R2 — object storage on the same network that serves your public job links.
Can another Opeo customer see my jobs or CRM?
No. Row-level security isolates each account. Your team must sign in to your workspace to access anything.
Does Opeo store credit card numbers?
No. Lemon Squeezy handles payment details. Opeo only stores enough billing metadata to apply your plan limits.
Do you support GDPR rights?
Yes. If you or your clients are in the EEA, see our Privacy Policy for lawful bases, retention, and your rights (access, erasure, portability). Email hi@opeo.io for data requests.
Do you sell customer data?
No. We do not sell personal information. Subprocessors (Cloudflare, Supabase, Lemon Squeezy, Resend, Sentry) process data only to run the service — listed in our Privacy Policy.
Need a DPA or security questionnaire?
Email hi@opeo.io with what your team needs. We will answer honestly about our stack and subprocessors.
Pricing also covers backups and encrypted transfer — see Support & Security on the plan comparison table.
Still have questions?
Ask about data location, subprocessors, or account deletion before you share your first job link. We typically reply within 2 hours on business days.