Security

How we protect customer data and how to report problems.

This page is the plain-language summary your security team needs before signing up. For deeper detail (audit questionnaires, sub-processor lists, the latest SOC-2 report under NDA), email security@ovriven.com.

1. Data in transit

All traffic between browsers, mobile clients, and our API terminates over TLS 1.2 or higher. HTTP requests are redirected to HTTPS at the edge. The deployment platform rotates certificates automatically; we do not pin individual certificate fingerprints in client code.

2. Data at rest

Persistent state lives in two stores, each with provider- side encryption enabled:

• Postgres — accounts, workspaces, runs, billing rows, audit logs. Hosted on a managed Postgres provider with encryption at rest.
• S3-compatible object storage — uploaded source materials and exported reports. Server-side encryption (SSE-S3 or equivalent) is enforced on every object.

3. Authentication

• Passwords are hashed with scrypt; we never store plaintext passwords.
• Google Sign-In via Google Identity Services is supported for users who prefer federated login.
• Optional TOTP-based two-factor authentication is available on every account from Account → Security.
• Admin step-up auth requires TOTP enrollment; admin sessions carry a separate verification timestamp the server checks on every privileged action.

4. Account lifecycle

• Account deletion is self-serve. Deletion soft-marks the row first; a scheduled sweep hard-deletes the record + all owned data after the soft-delete TTL.
• GDPR data-export endpoint produces a machine-readable archive of every row keyed to the requesting account.
• Workspace ownership transfer is supported before deletion so collaborators don't lose access to shared work.

5. Audit logging

Every privileged admin action — promoting an admin, suspending a user, soft-deleting a run, granting credits, revoking a session — writes an append-only row to admin_audit_logs. Logs are queryable from the admin console and rotated to cold storage by a scheduled cron after the configured retention window (default 365 days). Customer-side audit logs at the workspace level are available on Team and Enterprise plans.

6. Vulnerability disclosure

We welcome reports from independent researchers. Please email security@ovriven.com with reproduction steps. We acknowledge new reports within two business days and will keep you posted as we investigate. We commit to:

• Not pursuing legal action against good-faith researchers who follow responsible-disclosure practice.
• Crediting reporters in release notes (with permission) when fixes ship.
• Treating active exploitation reports as P0 incidents.

7. Sub-processors

The current, authoritative list of sub-processors (cloud hosting, managed Postgres, object storage, transactional email, payment processor, LLM provider) is maintained at /sub-processors. We notify customers before adding a new sub-processor and provide a 30-day window to object.

Simulations are powered by OpenAI models. The full provider list, with the data each one processes, is on the Sub-processors page.

This page is a living summary. For the most current statement, request the latest signed security overview from your account contact.