Security

Our approach

Otto Pilot handles pipeline data your business depends on. We keep the surface area small: least-privilege access, encrypted everywhere, and no data collected that the product does not need.

Infrastructure

• Hosted on managed cloud infrastructure with our database and serverless functions on Supabase (SOC 2 Type II audited infrastructure).
• All traffic is encrypted in transit with TLS 1.2+; data is encrypted at rest.
• Secrets and API keys are stored server-side only and never shipped to the browser.

Access control

• Workspace data is isolated per customer and protected with row-level security.
• Integration connections use OAuth where the provider supports it; you can revoke any connection at any time and we drop the tokens.
• Internal access to production is limited to the founders, logged, and used only for support you request.

AI data handling

• Requests to AI model providers carry only the data needed for the task you asked for.
• Your private workspace data is not used to train models for other customers.

Subprocessors

Supabase (database, functions), AI model providers used for processing, Cal.com (scheduling), and our email delivery provider for The Signal. We will update this list as it changes.

Reporting a vulnerability

Found something? Email [email protected] with details. We read every report and respond quickly.