Trust & Security

What we do with your data, stated plainly.

OTP is pre-SOC 2 and targeting SOC 2 Type II within six months. We document our controls openly here rather than hide behind a badge we have not yet earned. Our infrastructure runs on Railway, which is SOC 2 Type II certified and HIPAA compliant.

Last updated July 26, 2026

Your operating data is private to your organization by default.
Nothing joins the cross-org network unless you explicitly publish it.
Customer data is hosted in the EU (Amsterdam) and encrypted at rest.
All traffic is encrypted in transit (TLS).
Every organization-level action is written to an audit log.
Every member can see what OTP holds about them, and who has looked.
We notify affected organizations within 3 hours of a confirmed breach.

The network boundary

If you publish to OTP, here is exactly who sees what.

Private by default. Your operational data is scoped to your organization and is never exposed on any cross-org surface unless you take an explicit action to publish it.

Stays private to you

Quarterly priorities / Rocks
Issues and To-Dos
KPIs and scorecard values
Meeting data (leadership meetings)
Org chart
Member identities and profiles
Meeting transcripts (auto-redacted before storage; raw text is never persisted)

Visible only when you publish

Each of these requires an explicit action by you.

Published learnings Only after you explicitly publish a learning to the network.
Best practices Only practices your organization chooses to publish.
Coordination patterns Derived only from published learnings, never from private data.
Org profile and chart Only if you set the organization profile to public.
KPIs Only KPIs you explicitly mark public.

private organizations

Organizations flagged private are hard-excluded from every cross-org surface — browse, search, the intelligence graph, recommendations, published best-practices listings, and the network API — regardless of any per-item publish setting.

Enforced through a single shared control so the rule cannot drift between surfaces. A boot-time check rebuilds the network data view to include the same exclusion.

Privacy is all-or-nothing at the organization level; there is no per-item private override.

Multi-tenant by design. Every record (priorities, to-dos, KPIs, meetings, org chart, learnings) carries an organization ID, and every request is bound to one organization before any data is read.

Tenant scoping is enforced in the application layer on every route, and every cross-org read additionally passes through one shared visibility control. We disclose plainly that isolation is enforced in the application, not via database row-level security.

Infrastructure & encryption

Where your data lives and how it is protected.

Hosting

Application and managed PostgreSQL 16 run on Railway. File storage on Cloudflare R2. Railway is SOC 2 Type II certified and HIPAA compliant; its SOC 2 report, BAAs, and penetration-test reports are available from Railway on request (trust.railway.com).

Data residency

EU West — Amsterdam, Netherlands (Railway region europe-west4).

Encryption

In transit, all connections use TLS. At rest, all customer data is encrypted at the storage layer by Railway, and service secrets carry an additional layer of encryption, decrypted only when needed. Application-issued tokens (demo access, email unsubscribe, admin impersonation) are signed with HMAC-SHA256 and verified in constant time. There is no application-level column encryption.

Retention

The realtime sync event log is pruned daily and retained 30 days. Audit logs are retained for 12 months. Most records use soft-delete (rows retained with a deletion timestamp for audit) until a hard-delete request is processed. Meeting recordings: when an organization's agent attends a meeting, the video and audio are retained for the window that organization selects (30, 60, 90, or 365 days; 90 by default) and then deleted automatically by a daily sweep. An organization can turn recording retention off, in which case future recordings are never stored (existing recordings live out their window). OTP instructs the recording vendor to delete its copy as soon as the transcript is retrieved; if that request cannot be completed, the vendor's own short retention window (currently 7 days) expires the media. Click-to-record audio (the browser recorder) is transcribed in the background: raw audio is held in object storage (encrypted at rest by the provider) from upload until its transcript is produced, then deleted in the same worker pass. If transcription fails repeatedly, that audio is retained so it can be recovered manually rather than lost. During an active recording session, audio segments are also buffered on the server's temporary disk and removed when the session is finalized, discarded, or after three hours of inactivity. Meeting transcripts: only the redacted transcript is retained, and by default it is kept until the organization deletes the meeting or its account. An organization can instead select an automatic transcript retention window (30, 60, 90, or 365 days); a daily sweep then clears the transcript text of completed meetings once the window has passed since the meeting ended. The meeting record, its AI-generated summary, and the transcript's append-only edit-audit trail are kept, and each sweep writes an audit entry. Email delivery telemetry is retained 90 days.

Backups & recovery

Daily automated PostgreSQL backups at 05:00 UTC, retained 30 days, stored in Railway-managed backup storage (EU West) and encrypted at rest. Recovery Point Objective 24 hours; Recovery Time Objective under 1 hour. Restores are performed and integrity-verified via the Railway dashboard, and restore operations are logged.

Data handling

Deletion, export, and AI processing.

Deletion

Day-to-day deletes are logical (soft-delete) so data can be recovered and audit trails preserved. On a verified deletion or right-to-be-forgotten request, personal data is permanently removed within 7 days.

Export

OTP imports from Ninety.io and Bloom Growth exports. Customers may request a copy of their data; a self-serve export endpoint is on the roadmap.

AI processing

AI features send the organization content needed for a given request to Anthropic's Claude API to generate a response. Anthropic does not train its models on data submitted through its paid API. The content sent depends on the feature: Ollie's meeting follow-ups and Ollie Insights send the relevant meeting's transcript and summaries plus related priorities, KPIs, to-dos and issues; the Ollie copilot sends the results of the specific tools it runs on your behalf; setup and import features send the documents you upload. Meeting transcripts are PII-redacted before storage and before AI processing. Ollie's copilot never changes your data inside a model turn: it proposes the change and executes only on your explicit, per-action approval. Two public marketing tools also call Claude but send only what a visitor types or pastes, PII-redacted, and never touch stored customer data. Organizations that configure their own Anthropic API key send their AI traffic to Anthropic under that key. AI output is accountable, not final: every Ollie Insight is signed, cites the records it drew on, and can be challenged by any member of the organization. A challenge stays attached to the insight, follows it through regeneration, and can be closed only by the person who raised it, never by rank.

Abuse protection

Abuse protection via per-IP rate limiting (600 requests/minute globally, with tighter limits on sensitive endpoints such as newsletter signup).

Access & security controls

The controls running on every request.

Authentication

Clerk-managed OAuth. OTP stores no passwords.

API access control

API keys are hashed (SHA-256) at rest and presented as bearer tokens.

Tenant isolation

Every request is bound to one organization before any data is read.

Privileged access

Admin "view-as" uses a signed cookie that binds the action to the acting admin for audit.

Audit logging

Organization registration, publishing, and key actions are recorded with actor and entity, retained 12 months.

Webhook verification

Inbound webhooks are verified via signature on the raw request body.

Subprocessors

Every third party that may process data.

Anthropic

AI processing

Powers OTP's AI features (Ollie meeting insights and copilot, Ask AI, setup assistance). Receives only the content needed for a given request. Does not train on data submitted via its paid API. United States

Clerk

Authentication

User authentication and session management. OTP stores no passwords. United States

Cloudflare R2

File / object storage

Stores uploaded files, meeting recordings, and assets. Global edge

Composio

Third-party integration connectivity

Brokers the OAuth connection when an outside tool is linked (e.g. Google Sheets, Jira, Trello). Shared tools are held on your organization's behalf. Personal tools (mail, calendar) are held per member, connect as that member alone, and are usable only in that member's own Ollie chat. Relays read-only tool calls; only active if a connection is made. United States

Deepgram

Speech-to-text transcription

Transcribes audio you record in OTP (in-app and phone recordings). Receives audio only for the requested transcription. SOC 2 Type II. United States

Google Ads

Marketing conversion tracking

Conversion measurement on public marketing pages only. Does not touch customer operational data inside the app. United States

Railway

Cloud hosting & managed PostgreSQL

Runs the OTP application and primary database. SOC 2 Type II, HIPAA. US company; data hosted in EU West (Amsterdam)

Recall.ai

Meeting recording bots

Runs Ollie, the meeting notetaker: joins video calls you invite it to and captures the recording and transcript. Only meetings you explicitly send Ollie to are processed. SOC 2 Type II. United States (us-west-2)

Resend

Transactional & newsletter email

Delivers account, notification, and newsletter email, and reports delivery and engagement events (delivered, opened, clicked, bounced) back to OTP. United States

Sentry

Error monitoring

Application error tracking. Error events are sent with cookies, auth headers, and credential-bearing URLs stripped; no request bodies are attached. SOC 2 Type II. United States

Stripe

Billing & payments

Processes subscription billing. Card data is handled by Stripe, not OTP. United States

Svix

Webhook delivery

Webhook relay and signature verification. United States

Incident response

If something goes wrong, you hear from us in three hours.

On confirming a security incident affecting customer data, we contain it and notify affected organizations within 3 hours, followed by a written post-incident summary.

No reportable security incidents to date.

Security audit

A comprehensive security audit was completed in July 2026, covering authentication, multi-tenant isolation, injection, the dependency supply chain, and file handling. Findings were remediated and verified in production, and the production dependency tree carries no known high or critical vulnerabilities; any remaining advisories are low or moderate and tracked to resolution. This was a code-level internal review, not a third-party penetration test — a formal external assessment is planned as we grow.

See what was hardened & live status →

Questions teams ask us

The answers your reviewers want.

If I publish to OTP, who can see my data?

By default, nothing. Your operating data stays private to your organization. Only items you explicitly publish (learnings, selected best practices, or a profile or KPIs you mark public) appear on the network.

Is my operational data (priorities, KPIs, meetings) ever shared?

No. Those are private to your organization and never appear on any cross-org surface.

Can I keep my whole organization off the network?

Yes. A private organization is hard-excluded from every cross-org surface through a single enforced control.

Where is my data stored?

In the EU, in Railway's Amsterdam region, encrypted at rest, with daily encrypted backups retained 30 days.

Do you use my data to train AI models?

No. AI features send only the content needed for that request to Anthropic's Claude API to generate your response, and Anthropic does not train on data submitted through its paid API.

Can I delete or export my data?

Yes. On a verified deletion request, personal data is permanently removed within 7 days. You can request a copy of your data, and a self-serve export is on the roadmap.

Does OTP track individual member activity?

OTP records an aggregate daily count of the changes each member makes, so an organization's leadership can see which days a person was active and roughly how much they did. It does not capture IP addresses, devices, pages viewed, or the content of any action. These numbers are visible only inside your own organization, to leadership roles, and to OTP platform administrators in aggregate.

Can I see what OTP holds about me?

Yes. Every member has a personal data page (Settings, My data) showing their identity record, what the organization holds that involves them, and who has viewed their meeting transcripts. This is a product surface, not a support request.

What if an AI-generated insight is wrong?

Challenge it. Any member can contest an Ollie Insight, or one specific receipt it cites, right where it appears. The challenge stays attached to the insight, anyone can respond, and only the person who raised it can close it. A wrong claim cannot be quietly outranked or regenerated away.

Are you SOC 2 or GDPR compliant?

We are pre-SOC 2 and targeting SOC 2 Type II within six months; our infrastructure already runs on SOC 2 Type II, HIPAA-compliant Railway. For GDPR, customer data is hosted in the EU and a DPA is available on request.