1. How the app is protected
Optibill is published by ETS EMANI STUDIO, in Makepe, Douala, Cameroon. The measures below concern the app and its services; their effectiveness also depends on the configuration used and on the access granted within your organization.
Authenticated sessions
In the web app, access to services relies on authenticated sessions and signed tokens. Their validity is checked before protected features can be used.
Hashed passwords
The web app uses BCrypt to hash passwords before storing them. Passwords are not kept in plain text.
Access tied to the organization
Application checks and queries take the user’s organization into account. Roles and permissions govern the available features.
Protected session cookies
In the web app, session cookies use HttpOnly and SameSite=Lax in particular, with the Secure attribute in production.
History of some operations
Some archive operations have a timestamped history to make actions easier to follow.
Browsing over HTTPS
Use the official HTTPS addresses to access the online services and check the domain before entering your credentials.
Data managed in the software, files stored on your computer and exchanges through a messaging app are not all covered by the same protection mechanisms.
2. Protecting your account and your team
- Choose a unique, long enough password and do not reuse it on another service.
- Protect the email account linked to your account: it may be used to receive recovery messages.
- Give each member only the permissions needed for their work and remove access that is no longer needed.
- Log out on shared devices and lock your computer when you step away.
- Check the domain and sender of the messages you receive. The team will never ask for your password or your authentication codes.
If you suspect unauthorized access, secure your email account, change your credentials through the official channels and contact us.
3. GCOM on Windows: protecting local data
Offline mode lets you continue business operations without the Internet. It keeps data on the computer used, so protecting that device and managing its backups are essential.
- Keep Windows and Optibill GCOM up to date.
- Use a protected Windows session and limit physical access to the computer.
- Protect the disk with the encryption available on your device.
- Keep backups suited to your business, on a separate medium, and check that they can be restored.
- Before changing computers, reinstalling or having a repair done, make a copy of your data.
The cloud link is an operating choice
Offline use and sending data to the cloud are separate uses. Check the link settings and the operations concerned; a cloud link alone does not replace your backup strategy.
Download the app from the link provided on the Optibill website and keep track of where the file came from. The team can help you prepare an installation or a migration.
4. WhatsApp, documents and sharing
GCOM Bot works from your linked WhatsApp account and needs the Internet. Protect this access and check the devices linked to your messaging app.
Before confirming an operation, read the summary again. Before sharing an invoice or a document, check the recipient and the information included. Only send the documents needed for the operation.
External services, including WhatsApp, Google Drive and your email provider, have their own security mechanisms and data processing policies. Their role is explained in the privacy policy.
5. Backups and continuity
Set up an organization suited to the volume of your business: regular copies of useful data, limited access to backups and checks that they can be restored. For the local version, keep a copy separate from the work computer.
If you need specific details on backup, hosting, retention or recovery for the online services, contact the team for the information that applies to your plan. Specific availability or recovery commitments depend on the terms agreed for the service.
6. Reporting an incident or a vulnerability
Write to [email protected], with [email protected] as an alternative contact. Give the service concerned, the date and time you noticed the issue, the steps that help understand it and its possible impact.
- Hide customer data and confidential information in your screenshots.
- Do not send any password, access token or recovery code.
- Limit your checks to your own accounts and to the information needed for the report.
- Let us know before publishing anything that could expose other users’ data.
The team reviews the reports it receives and may ask you for details to assess and handle the issue. If an incident involves personal data, the applicable notification obligations are also taken into account.
7. Your contacts and your rights
Security: [email protected].
Personal data: [email protected]. See how to exercise your rights in the privacy policy.
Publisher: ETS EMANI STUDIO, Makepe, Douala, Cameroon. Other contact: [email protected].
This page is updated to reflect the measures and uses of the service. Its update date is shown at the top of the page.