The strongest privacy guarantee is architectural, not a promise: your statistics and the notebook's Python run in your browser, so raw data never has to reach our servers. Everything you do choose to save is encrypted in transit and at rest, isolated per researcher in the database, and recorded in an audit log a session can't forge. Here is exactly what we enforce — and exactly what we don't claim.
No marketing translation. These are the actual primitives, where they run, and what they cover.
No single control is a point of failure. These controls are independent, so a weakness in one does not automatically expose the others — from the network edge to a database engine that refuses to return another tenant’s row.
Traffic is encrypted in transit (TLS) and filtered at our hosting provider's network edge before it reaches application code.
A strict set of HTTP security headers constrains what the browser will execute, load, or expose.
Identity is verified on every request, and credentials are protected with standard cryptography.
Even with a valid session, every row is gated by database-enforced access policies, not just app logic.
Stored data is encrypted on disk and in backups using strong, modern ciphers.
Security-relevant actions are recorded in an append-only log that user sessions cannot forge, alter, or delete.
Trust erodes the moment a security page overstates. So the honest version sits right next to the enforced one, in the same size type.
SOC 2: Olto Discovery is built on security-conscious infrastructure with SOC 2-aligned controls in mind, but it has not undergone a SOC 2 audit as of this writing. We rely on infrastructure providers with established security programs, including SOC 2-compliant vendors where available.
HIPAA / PHI: Olto Discovery is not, by default, a HIPAA-covered platform. A HIPAA-capable configuration with a Business Associate Agreement (BAA) is available for Enterprise customers under a separately scoped enterprise agreement. Until such an agreement is in place, do not upload protected health information.
Transport & encryption: Data is encrypted in transit (TLS) and at rest (AES-256), but the Service is not end-to-end encrypted — AI prompts, uploaded files, and conversations are sent to our AI provider to function. HTTP Strict Transport Security (HSTS) is not currently enforced; connections are still served over HTTPS with HTTP redirected to it.
Restricted data: Unless expressly permitted in a signed Enterprise agreement with an appropriate compliance configuration, do not upload PHI, patient-identifiable clinical data, classified information, export-controlled data, controlled unclassified information (CUI), or other regulated sensitive data.
For where we align (and where we do not yet) with NIST CSF 2.0, OWASP ASVS L2, the NIST 800-series, and our FIPS-approved crypto posture — stated honestly, including what remains — see the Compliance & Trust page.
Olto secures the platform, infrastructure configuration, application controls, and database access policies. You decide who is in the workspace, how they sign in, and what data goes in.
Everything below lives in your account Settings — no support ticket required.
We welcome responsible disclosure. Report a suspected vulnerability and we'll acknowledge it and work with you on a coordinated fix. Our Vulnerability Disclosure Policy spells out scope, safe-harbor protection, and the rules of engagement — and complements the machine-readable security.txt we publish.
security@oltodiscovery.com