# Ovriven — Trust Pack

_Last reviewed: 2026-05-31. The authoritative live versions of each
section below live at `/security`, `/sub-processors`, `/dpa`,
`/soc2`, and `/status`. This bundle is the single-file view for
your buyer-side security review._

## 1 · What we do

Ovriven is a large-scale agent simulation SaaS. A user enters a
scenario; we generate a population of synthetic agents with
structured profiles, run a closed-loop simulation of how those
agents react and influence each other, and produce a Discussion
+ Results report. Every output is framed as a simulation-based
estimate — never as a survey result or a public-opinion oracle.

Target customer is professionals doing evidence-based decision
work (PMs, analysts, founders, researchers, journalists, solo
consultants — Pro tier) and small professional teams collaborating
in shared workspaces (Team tier). Enterprise tier covers election
forecasting, regulated industry, and compliance-driven use.

## 2 · Data we process

- **Account data**: email, display name, optional Google sign-in.
- **Workspace data**: workspace name, members + roles, shared
  uploads, shared simulation outputs.
- **Run inputs**: stimulus prompts, attachments (PDF, PNG/JPEG,
  MP4/MOV/WebM up to 8 MB). Stored encrypted at rest in S3.
- **Run outputs**: simulation summaries, group reasoning,
  replay frames, exported reports. Stored in Postgres + S3.
- **Usage telemetry**: LLM token counts, credit ledger entries,
  webhook delivery state. Stored in Postgres.

We do NOT collect: demographics, personal attributes about
real people the user mentions in prompts, voice/biometric data,
location data beyond the country code already in HTTP geo
headers (used only for pricing localization).

## 3 · Security posture

- **Encryption in transit**: TLS 1.2+ everywhere, HSTS on the
  app domain, no mixed-content fallbacks.
- **Encryption at rest**: AES-256 on all storage layers
  (RDS Postgres, S3 buckets, Stripe customer records).
- **Authentication**: scrypt-hashed passwords (per-user salt),
  bearer-token sessions in `httpOnly`+`SameSite=Lax` cookies,
  Google Identity Services for OAuth sign-in. Admin actions
  step up to a TOTP-second factor.
- **Authorization**: per-run readability is gated on owner or
  workspace membership; cross-user reads of private runs return
  404 (never 403, to avoid existence leakage). Audit log
  records every admin mutation in an append-only chain.
- **Network**: API behind Cloudflare; rate-limited per-user and
  per-IP at the edge. No public database ports.
- **Secrets**: stored in the deployment platform's secrets
  manager, never in git. `.gitignore` blocks `.env`; gitleaks
  runs against every PR via `make secret-scan`.
- **LLM provider**: OpenAI gpt-5.4 with zero-data-retention
  enabled on the API tier — prompts + completions are NOT used
  to train OpenAI models.

## 4 · Operational hygiene

- **Backups**: daily Postgres snapshots (35-day rolling), S3
  bucket versioning on every object key.
- **Monitoring**: structlog + OpenTelemetry traces shipped to
  the deployment platform; Prometheus counters for queue depth,
  worker concurrency, webhook delivery success.
- **Incident response**: on-call rotation; security incidents
  go to `security@ovriven.com` with a 24-hour ack
  SLA. Customer notification for any incident touching
  customer data within 72 hours of confirmation.
- **Patching**: weekly dependency scan; high+critical CVEs
  patched within 7 days of disclosure.
- **Background jobs**: arq worker with idempotent retry; failed
  webhooks record the last error on the row but never retry
  forever.

## 5 · Sub-processors (summary)

| Processor | Purpose | Location |
| --- | --- | --- |
| OpenAI | LLM provider | US |
| Stripe | Billing + customer portal | US / EU |
| AWS | Compute + Postgres + S3 | US (us-east-1 / us-west-2) |
| Cloudflare | Edge CDN + DDoS protection | Global edge |
| Google | Optional sign-in + Drive export | US / Global |
| SendGrid / Postmark / SES | Transactional email | US |

Full table + privacy-policy URLs + data-category breakdown:
`/sub-processors`.

## 6 · Account lifecycle

- **Signup**: email + password OR Google sign-in. Verification
  email is required only to act on account-recovery flows.
- **Deletion**: self-serve from Account → Delete account. 30-day
  recovery window, then hard-delete via `make sweep-deletions`
  (audited).
- **Retention policies**: per-workspace `retention_days` +
  `archive_after_days` enforced by the
  `make sweep-retention` cron. Defaults to no automatic
  deletion; Team and Enterprise customers can configure
  per-workspace limits.

## 7 · Data Processing Agreement (DPA)

GDPR Article 28-compliant DPA covers Team and Enterprise
customers. The full text is at `/dpa`. Standard Contractual
Clauses are included for EU-to-US transfers. If your security
team needs a redlined version against your template, email
`security@ovriven.com`.

## 8 · SOC-2

SOC-2 Type II audit is in progress: an external auditor's
observation window is underway, covering security, availability,
and confidentiality. Until the report is issued, our current
security overview, controls inventory, gap analysis, and expected
completion timeline are available under NDA — email
`security@ovriven.com` to request them. (This mirrors `/soc2`,
the authoritative live page.)

## 9 · Procurement downloads

Redline-friendly templates + pre-filled answers (all under
`/procurement/` on this origin):

- **MSA template** — `/procurement/msa-template.md`
- **Order Form template** — `/procurement/order-form-template.md`
- **DPA template (executable)** — `/procurement/dpa-template.md`
- **Vendor security questionnaire (standard answers)** —
  `/procurement/vendor-security-questionnaire.md`

Tax forms (W-9 / W-8) are available on request via
`legal@ovriven.com`.

## 10 · Company & contacts

- Product name: **Ovriven** (a large-scale agent simulation SaaS). Legal entity name, registration number,
  and registered address are provided in the contracting documents
  (MSA / Order Form / DPA) via `legal@ovriven.com`.
- Security questionnaires + procurement reviews:
  `security@ovriven.com` (2-business-day SLA).
- Vulnerability disclosure:
  `security@ovriven.com` (PGP key on `/security`).
- Data protection / DPA execution: `legal@ovriven.com` ·
  `privacy@ovriven.com`.
- Abuse reports: `abuse@ovriven.com`.
- General buyer questions: `sales@ovriven.com`.

---

_Generated 2026-06-11. Sources: `/security`, `/sub-processors`,
`/dpa`, `/soc2`. Live versions take precedence over this
snapshot._