Trust · Self-graded — not a third-party audit

Built to recognized standards.
Honest about where we are.

Olto Discovery, operated by Velora Biotech LLC, implements the technical controls defined by leading U.S. security frameworks. The statuses below are our own engineering self-assessments, not third-party attestations — we are not currently certified or authorized under any of them, and we say so plainly. Trust is earned by accuracy, not by badges — the same principle that makes a reproducible protocol worth publishing.

Compliance ledger · 10 frameworksself-graded · updated as controls change
OWASP ASVS Level 2
Application security verification
Strong alignment

Self-assessed alignment with OWASP ASVS Level 2 (methodology available on request). RLS at the database engine, TOTP MFA (opt-in, fail-closed once enrolled), validated uploads, durable rate limits, and CSRF/XSS/SSRF/open-redirect protections are in place.

NIST SP 800-218 (SSDF)
Secure software development
Strong alignment

CI runs static analysis, secret scanning, dependency audit, and SBOM generation on every change, with code owners assigned to security-critical paths.

NIST SP 800-63 (Digital Identity)
Authentication / AAL2
In progress

Multi-factor authentication is available and, once a user enrolls, the TOTP challenge is enforced fail-closed at the edge — a session that hasn’t cleared AAL2 is blocked from the API. MFA is not yet mandatory for all accounts. Recovery codes are single-use and stored only as hashes; passkey support is on the roadmap.

NIST SP 800-207 (Zero Trust)
Architecture
Strong alignment

No trusted internal network: every authenticated request to the data plane is authorized per-session, with authorization enforced at the database engine as the last line of defense.

FIPS 140-3
Approved cryptography posture
Readiness

Cryptographic operations are centralized in a single internal module that uses only FIPS-approved algorithms, ready to run against a FIPS-validated provider. Note: using FIPS-approved algorithms is not FIPS 140-3 module validation, which remains a hosting milestone.

NIST SP 800-53 (Moderate)
Federal control baseline
Readiness

The technical controls across access, audit, identity, system protection, and integrity are implemented and mapped. Written policies and assessment remain.

NIST SP 800-171 r3
Protecting CUI
Readiness

Technical controls largely map to the baseline. A defined CUI boundary, policies, and a System Security Plan are prerequisites before any CUI is processed.

NIST CSF 2.0
Cyber-risk governance
In progress

Identify / Protect / Detect / Respond functions are well-covered by implemented controls; the Govern function (formal policy and risk governance) is the active gap.

CMMC Level 2
DoD contractor (CUI)
Pre-assessment

Technical practices are substantially in place. Certification requires written policies, a System Security Plan, a POA&M, and a C3PAO assessment.

FedRAMP Moderate
Federal SaaS authorization
Pre-assessment

Early readiness. Authorization requires a FedRAMP-authorized hosting boundary, continuous monitoring, a 3PAO assessment, and an agency ATO — a funded, multi-quarter program.

How we back it up

Alignment isn't a slide. These are the mechanisms running in production and in our build pipeline today.

01
Tenant isolation at the database engine

300+ row-level security policies across 200+ tables gate rows at PostgreSQL itself — not just in application code — so an app-layer bug is far less likely to cross tenants, because the database enforces isolation independently of the application.

02
A verification gate on every change

Type-checking, 7,500+ automated tests (as of July 2026), linting, and a production build must pass before code ships. A dedicated test asserts that no data-changing route is reachable without authentication.

03
A continuous secure-development pipeline

Static analysis (OWASP Top Ten), secret scanning, dependency vulnerability audits, and a software bill of materials run automatically — and re-run weekly against newly disclosed vulnerabilities.

04
Centralized, approved cryptography

Cryptographic operations are centralized in one internal module that uses only FIPS-approved algorithms, with an automated guardrail that blocks weak algorithms from entering the codebase.

05
Tamper-evident audit logging

Security-relevant actions are recorded through a privileged server-side path that ordinary user sessions cannot write to directly, designed to be tamper-evident and retained on a defined schedule.

06
Scanned with an external DAST tool

A self-run OWASP ZAP scan returned zero critical or high findings. A scoped penetration test by an independent firm is on our roadmap. This complements our internal security-audit cycles.

Questions, or need our control mappings?

We maintain detailed control-to-evidence mappings (NIST 800-53/171, CSF 2.0, ASVS, SSDF) for security reviews. Security researchers can report issues through our responsible disclosure policy.

How our defenses workResponsible disclosure