Data handling
Where your data lives, who can see it, and how to get it back.
A plain-English summary of how OpX handles customer data — collection, storage, access, retention, export, deletion.
Data residency
All Customer Data is stored and processed in AWS eu-west-2 (London) via the Supabase managed platform. Customer Data does not leave UK borders in the normal course of processing. Sub-processors with potential non-UK processing are listed and bound by UK IDTA / SCC.
Data categories
| Category | Examples | Mandatory? |
|---|---|---|
| Identification | Name, work email | Yes |
| Role / organisational | Job title, team, manager | Optional |
| Authentication | Hashed password (or none if SSO-only), MFA enrolment status | Yes if not SSO |
| Learning records | Enrolments, completion, attempts, scores, time-on-task | Generated by use |
| Workflow records | Improvement actions, approvals, comments | Generated by use |
| Audit trail | Login events, admin actions, role changes | Generated automatically |
- Category
- Identification
- Examples
- Name, work email
- Mandatory?
- Yes
- Category
- Role / organisational
- Examples
- Job title, team, manager
- Mandatory?
- Optional
- Category
- Authentication
- Examples
- Hashed password (or none if SSO-only), MFA enrolment status
- Mandatory?
- Yes if not SSO
- Category
- Learning records
- Examples
- Enrolments, completion, attempts, scores, time-on-task
- Mandatory?
- Generated by use
- Category
- Workflow records
- Examples
- Improvement actions, approvals, comments
- Mandatory?
- Generated by use
- Category
- Audit trail
- Examples
- Login events, admin actions, role changes
- Mandatory?
- Generated automatically
Special category data
OpX has no dedicated fields for special category data (health, racial / ethnic origin, religious belief, biometric, genetic) or criminal offence data. Where customer administrators choose to record such information in free-text fields, the customer remains the controller and is responsible for the additional Art. 9 / Art. 10 lawful basis.
Retention
Active records
Retained while the customer tenancy is active.
Learning records
Configurable per customer. Common position is 6–7 years aligned to standard regulatory record-keeping for staff training.
Audit logs
Retained per platform default; ≥ 12 months supported via scheduled export.
Export and deletion
Customers can export all tenant-scoped data on demand via the admin console, REST API, or scheduled CSV / JSON export to a customer-managed S3 or SFTP target. On contract termination, we provide a 90-day export window in industry-standard formats (CSV / JSON / PDF), at no charge, before secure deletion. Deletion is certified in writing on request.
Data subject rights
Data subject access, rectification, erasure, portability, and objection requests received via OpX are actioned within statutory timelines (typically within one month, extendable as permitted under UK GDPR Art. 12(3)). Email security@opx.io.