Security Overview

AssociationOps360 uses a risk-based approach focused on customer and property separation, least-privilege access, protection of operational records, controlled changes, evidence-backed releases, incident response, and service recovery. Security requirements apply to the public website, secured application, customer records, attachments, reports, exports, integrations, and supporting infrastructure.

This Overview does not claim that AssociationOps360 holds SOC 2, ISO 27001, HIPAA, or another independent certification. Render maintains its own compliance program, but a provider certification does not automatically certify AssociationOps360.

The public sales website and authenticated customer application are separate surfaces. Customer-login links remain hidden unless a verified HTTPS application destination is configured. Prelaunch and staging environments must remain separated from production credentials and data.

Render is approved as the staging infrastructure provider, with Virginia planned as the staging region. The exact service, datastore, persistent-disk, network, environment, and access configuration must be recorded and verified after deployment.

The application uses named-user access and role-based permissions. Manager and Admin roles contain approval authority; Technician and Lifestyle roles do not approve; requester and view-only roles remain restricted. Paid active-user access must not be shared or pooled.

Amazon Cognito is configured for private-staging identity work in U.S. East, with email sign-in, public self-registration disabled, generic sign-in failures, and token revocation. It is not integrated with the application and is not handling Customer Personal Data. Production sign-in, session security, account recovery, administrative access, credential revocation, and multi-factor authentication remain hosted-verification gates. Internal or administrator visibility does not prove that a customer role is entitled to a feature.

Application logic and focused regression tests enforce organization, property, record, report, and attachment boundaries. Scheduled-report privacy, photo access, and selected workflow isolation tests have passed in controlled local conditions.

The complete role-by-property-by-record isolation matrix remains subject to hosted end-to-end verification using representative users, devices, exports, and failure paths before production certification.

Hosted traffic must use HTTPS. Render states that data in transit uses TLS and covered database storage is encrypted; AssociationOps360 must verify that the deployed application and every datastore, disk, backup, and external connection use the intended protected path.

Approved photo requirements include automatic optimization before permanent storage, metadata reduction, thumbnails, duplicate-safe retry behavior, ten images per upload batch, twenty-five per work order, and one hundred per project. Complete-file exports and record linkage are implemented; workbook and PDF image rendering remain subject to the relevant implementation and QA evidence.

Source control, environment templates without real secrets, automated type, lint, test, build, brand-integrity, customer-access, and secret-scan checks support controlled releases. Staging candidates are sealed with a recorded revision and manifest, and affected workflows must be exercised before deployment.

A passing narrow test or successful process start does not prove a release. Verification must cover rendered behavior, role boundaries, data persistence, integrations, failure states, and the actual deployed result.

The application records relevant security and operational events where implemented. Production monitoring, alert routing, structured log retention, abuse detection, and escalation ownership are not represented as active until configured and tested on Render.

Confirmed security incidents are handled under the Customer Subscription Agreement, Data Processing Addendum, and Support Policy. Reports should be sent promptly to support@associationops360.com with the affected organization, property, time, user, and available evidence, without passwords or unrelated sensitive data.

Staging uses durable storage only when a Render persistent disk or approved datastore is attached and verified. Backup schedules, retention, restore procedures, recovery ownership, and recovery objectives must be configured and tested before production claims are published.

No uptime percentage, recovery-time objective, recovery-point objective, or twenty-four-hour operational response is promised unless it is supported by deployed evidence and stated in an applicable Order Record or published service schedule.

Render is the only active approved direct staging subprocessor. Amazon Cognito is configured for private-staging identity work in U.S. East, with no application integration, end-user account, or Customer Personal Data flow yet. Its final data flow and lifecycle verification must be completed before activation in the application or any production use. Email, payment, object storage, monitoring, backup, support, analytics, advertising, mapping, push-notification, and AI providers remain unapproved until selected, reviewed, configured, tested, and added to the Subprocessor List.

AssociationOps360 maintains a DPA, Privacy Policy, Cookie Policy, and change process for direct subprocessors. Render’s own provider chain is governed by Render’s DPA and trust materials.

Customers must authorize users, assign accurate roles and properties, protect credentials and devices, secure exported copies, remove access promptly, use supported workflows, keep contact details current, and report suspected compromise. Customers must not submit prohibited sensitive information through ordinary workflows.

AssociationOps360 organizes operational information but does not replace qualified inspection, emergency response, professional judgment, equipment instructions, or the customer’s legal and safety responsibilities.

Locally verified: controlled source and build checks; fail-closed customer-link configuration; selected tenant, report, attachment, preventive-maintenance, inventory, upload-limit, and export-package regressions; rendered legal pages; and sealed staging-candidate controls.

Hosted verification required: Render region and access; HTTPS and session behavior; persistent data and media storage; backup and restore; monitoring and alerting; production account recovery; rate and request limits; background-job ownership; email and billing providers; live-device evidence; and full end-to-end role and workflow certification.

Security questions and responsible reports may be sent to support@associationops360.com. AssociationOps360 may request information needed to verify identity, authority, organization, property, affected records, and scope before disclosing security information or changing access.

This Overview will be updated as hosted controls and providers are verified. A control will not be described as active merely because it is planned, present in a template, or available from a provider.