SECURITY
How Medya Ops protects your data.
This page describes how the platform is actually built, in plain terms — not a compliance certificate. We haven't pursued a formal certification (SOC 2, ISO 27001) yet; if that matters for your organization, ask us directly at hello@medyaops.com and we'll tell you plainly where we stand.
Every organization's data is isolated at the database level
Medya Ops is multi-tenant: many organizations share the same application and database. Isolation between them isn't enforced only in application code — it's enforced by PostgreSQL's row-level security, applied and forced on every table that holds an organization's data. A query running under one organization's session cannot read or write another organization's rows, even if a bug in the application layer tried to let it.
Passwords and sessions
- Passwords are hashed with a modern, industry-standard algorithm before storage — we never store or can recover a plain-text password.
- Sessions are server-side and cookie-based, with idle and absolute expiry.
- Every state-changing request requires a CSRF token in addition to the session cookie.
- Repeated failed sign-in attempts are throttled.
Payments
Card payments are processed by Paystack. Medya Ops never sees or stores your card number — Paystack handles the charge directly and hands back a confirmation, which we verify server-side (including checking the payment's authenticity via a cryptographic signature) before crediting your account.
Document extraction and AI
When your organization extracts data from a document (a media plan PDF, for instance), that document's content is sent to a third-party AI provider's API to produce the extraction — that's the one point in the product where content leaves our own infrastructure for a third-party AI provider. Nothing else in Medya Ops is AI-generated or AI-processed: order generation, package assembly and reconciliation are deterministic logic, not a model call. See Privacy for the full subprocessor list, including how to ask which provider is currently in use.
Auditability
Actions that create, approve, send or reconcile anything are recorded in an append-only audit log — who did it, when, and what changed — so an organization's own history can be reviewed rather than taken on trust.
Reporting a security issue
If you believe you've found a security vulnerability, email hello@medyaops.com with details. We don't yet run a formal bug bounty program, but we take reports seriously and will respond directly.