Opttab connects to brands' product feeds, analytics, commerce platforms and customer engagement tools, and runs agents that act on their behalf. This page explains how we protect that access.

Infrastructure

Hosted on Amazon Web Services (AWS) in the EU (Ireland, eu-west-1).
Data encrypted in transit with TLS and at rest with AES-256 (AWS Key Management Service).
Customer workspaces are logically separated.

Access to your systems

You choose which sources to connect and which actions an agent may take.
Credentials and tokens for connected systems are stored encrypted in AWS Secrets Manager.
Each Brand Agent runs through its own remote MCP endpoint (for example mcp.opttab.com/yourbrand) with scoped authentication.
Every agent invocation is logged with a journey ID, so you can see what was requested and what happened.
You can disable an action, an integration or the whole agent at any time.

People and process

Staff access to production follows least privilege and requires multi-factor authentication.
Staff are bound by confidentiality.
We review subprocessors before onboarding them. See Subprocessors.

Privacy

We act as a processor for your data under our DPA.
We do not use customer data to train AI models, and our AI model providers (OpenAI, Anthropic and Google) do not train their models on data we send through their APIs.
Opttab never processes payments from your shoppers. Your own checkout handles them.

Compliance status

GDPR: Opttab is based in the Netherlands and processes personal data under the GDPR.
EU AI Act: our agents disclose to shoppers that they are talking to an AI system.
SOC 2 / ISO 27001: Opttab does not currently hold a SOC 2 report or an ISO 27001 certification.

Report a vulnerability

See our Vulnerability Reporting Policy or email security@opttab.com.