Security model
Monitoring with a narrow boundary.
Each workspace owns its projects, preferences, executions and alert destination.
Read-only Google access
TriggerOps reads execution metadata and account identity. No API route deletes Google projects or triggers, edits script source or reads Workspace contents. Same-name activity without a Script ID is explicitly unverified.
Account protection
Google sign-in uses expiring, single-use state, server-side sessions and HTTP-only cookies. Token encryption uses a dedicated key. State-changing workspace requests validate their origin. Production and preview storage namespaces are separate.
Data and alert isolation
The authenticated session determines the workspace. Request bodies do not choose another tenant. Telegram destinations require a short-lived private-chat pairing link. SDK credentials belong to one workspace and support revocation.
Safe failure
A delayed Google sync suspends missed-run detection. An uncertain alert-delivery outcome is recorded for review instead of immediate duplicate messages. Optional SDK transport failures do not replace the result or exception of your own function.
Private-beta status
Application tests and operational validation are distinct. Public commercial release depends on live OAuth, secret rotation, tenancy, alert delivery and reliability validation. This page makes no certification or audit-completion claim.