Security & compliance

How Ophelia handles PCI scope, encryption in transit and at rest, and data retention.

We never store real payment or credential data. The sensitive fields you send — card number, CVV, expiry, cardholder name, and account passwords — are redacted from the stored booking record, from logs, and from every API response. They are forwarded only to the upstream provider to complete the booking.

• In transit — all traffic to api.opheliaos.com is encrypted over TLS.
• At rest — any value that must persist while a booking runs (card, OTP, password) is encrypted with AES-256-GCM authenticated encryption and decrypted only in memory at execution time.
• Not retained — card numbers and CVV are never written to the booking record, logs, or responses, in line with PCI-DSS principles.

API keys are stored only as a hash, never in plaintext — the full key is shown once at creation and cannot be recovered afterward.