BehaviourOps is built on the Base44 platform, which is independently certified to:
All data in transit is encrypted using TLS. All data at rest is encrypted on the platform.
Payments are handled entirely by Stripe, which is PCI DSS certified. BehaviourOps never sees, stores, or processes card data.
Players joining our free public challenges do not need to create an account - a display name only. Organisation campaigns are private: the campaign owner chooses what players provide - alias only, name and team (the default), or name, work email and team only where the organisation actively opts in. Any individual information is linked only to that organisation's private campaign.
The only people with accounts are facilitators - the people running sessions on behalf of their organisation. We collect name and work email address only.
This is deliberate. We believe you should only collect what you actually need.
BehaviourOps runs on Base44 infrastructure, currently hosted in the United States. Base44 uses Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF) for GDPR-compliant international transfers. Organisations with specific EU or UK data residency requirements should contact us to discuss options.
Facilitator and admin roles are separated. Facilitators can only access their own sessions and results. Admin access is restricted to authorised BehaviourOps personnel only. Admin routes are not publicly accessible.
API credentials and secrets are stored in an encrypted vault and are never exposed on the client side.
All payment processing is handled by Stripe. We use Stripe's hosted checkout - no card data passes through BehaviourOps systems. Stripe is PCI DSS certified. See stripe.com/docs/security for full details.
BehaviourOps is committed to GDPR and UK GDPR compliance. We process the minimum data necessary. Team-level reporting is our default. A Data Processing Agreement (DPA) is available on request for enterprise customers. Email behaviourops@crmda.co.uk to request one.
If you discover a security vulnerability in the BehaviourOps platform or games, please report it responsibly to: behaviourops@crmda.co.uk
We commit to acknowledging all reports within 5 business days. Please do not publicly disclose vulnerabilities before we have had the chance to investigate.