Read these before you read anything else we claim.
Every positive claim on this site is meant to be checkable. Publishing the negatives is how you can tell the positives are load-bearing.
9 entries · as of August 2026 · generated from PLATFORM_TRUTHS
Identity and access
Two-factor authentication is not force-enrolled for administrators.
TOTP two-factor is available on every account and is fail-closed once a user turns it on, but turning it on remains that person’s decision.
Two-factor authentication cannot be enforced organization-wide.
There is no SSO or SAML for a policy to attach to, so enforcement is per account; SSO and SAML are listed as planned. See what is planned
Integrations and clients
There is no public or programmatic API.
The internal page named Developer Portal is an operations console, not a developer surface; a documented API with scoped keys is listed as planned. See what is planned
There is no native iOS or Android app.
The web app is responsive and installable to a home screen as a PWA, and that is the whole of the mobile story.
The desktop app is not code-signed or notarized.
A real desktop build ships for Windows, macOS and Linux, but because it is unsigned your operating system warns on first launch: treat it as a developer preview, and use the browser if you would rather not see that dialog. See what is planned
Encryption and transport
Olto is not end-to-end encrypted.
Data is encrypted in transit and at rest, but anything you send to an AI feature (a prompt, a file, a conversation) is transmitted to the AI provider, and Olto can read what it stores.
HSTS is not enforced.
The Strict-Transport-Security header is served with max-age=0, so a browser is not instructed to refuse a plain-HTTP connection to this domain.
Independent audit and regulated use
No independent SOC 2 audit has been completed.
Controls are built with SOC 2 in mind, but no third-party auditor has examined them and Olto holds no security certification; an audit is listed as planned. See what is planned
Olto is not a HIPAA platform by default, and no BAA is offered on standard plans.
A HIPAA-capable configuration with a Business Associate Agreement is available to Enterprise customers under a separately scoped agreement; until one is signed, do not upload protected health information.
It is generated from the same constant the product pages read.
Each line above is one boolean in src/lib/marketing/facts.ts. The About and Download pages import that same constant and branch on it, so the sentence you read there and the sentence you read here come from one value. Flip a flag in the code and the statement here changes with it; once something stops being a limit, its entry drops off this page.
What this page is not.
It is not the complete set of things Olto cannot do, and it is not a scope statement. It covers the claims that buyers and reviewers ask about, which is why it is short. For what is enforced today read Security, for where Olto stands on frameworks read Compliance, and for the rest of the trust center go back to Trust. Olto also declines to publish an uptime percentage, and Status says why.