Deployment
Cloud, your model keys, or self-hosted.
Security at Othor AI
You choose where your data goes, and we show you exactly what happens on each path.
Source tables
Not persistently stored
Model training
Never on your data
SOC 2 Type II
Observation underway
Principles
We're an early-stage company with our first customers, building out security practice as fast as we responsibly can — but the principle underneath it doesn't depend on our stage. You decide where your data is stored, where Othor runs, and which model touches your numbers.
Deployment
Three ways to run Othor.
Most BI platforms give you one architecture and ask you to accept it. Pick the option that matches your risk tolerance.
01
Othor Cloud
We host the platform in AWS and route analysis through our model providers. Enterprise customers can request a different region where residency requires it.
Signals this week, standard SaaS processing chain.
02
Cloud + your keys
We host the platform, you bring your own provider contract and keys. Analysis runs under the terms you already negotiated, including zero-retention tiers.
For teams with an existing AI provider agreement.
03
Self-hosted
Othor runs inside your perimeter. Paired with a model you host, no business data reaches us or any external provider.
For regulated data and strict residency requirements.
Commitments
What we will and won't do with your data.
Certifications arrive on an auditor's timetable. These promises don't — they hold today, on every plan and every deployment path.
We don't warehouse your data
Othor keeps the answer, not a copy of the tables behind it.
Your data never trains a model
Not ours, not a provider's. Our agreements prohibit it.
We don't lock you to one model
Bring your own keys, assign models per task, switch any time.
We don't force our infrastructure on you
Deploy inside your own network if your data can't leave it.
We don't sell or share your data
No resale, no advertising use, nothing beyond required sub-processors.
We don't claim what we haven't earned
Every control below carries its real status, roadmap included.
What we hold
Kept, cached, or never touched.
Security questionnaires usually spend three rounds establishing this. Here it is up front, including the middle column most vendors leave out.
Retained
While your account is active
Connection credentials, encrypted.
Column names, types and definitions
Insights, narratives and charts we generate
Workspace and dashboard configuration
Account details and usage analytics
Held Transiently
Caches that expire on a defined TTL
Query results materialised during an analysis
Extracted tables from document sources, where the connector requires it
Cached responses that avoid re-running identical analyses
Never Retained
Not stored by Othor at any point
Persistent copies of your source tables
Warehouse-style replicas of your databases
Payment card details
Protected health information
Nothing cached is used for model training. Credentials are removed when you terminate your account, and we'll put the retention behaviour of any specific connector in writing.
Controls
What's running today.
Othor is AI-native, so a model is genuinely in the path of your data. This covers that path and everything around it.
AI processing
IN PLACESource data is read to answer a question and sent to the configured model. What persists afterwards is the generated insight. Provider agreements prohibit training on submitted content; zero-retention processing is available via enterprise agreements or your own keys.
Storage location
IN PLACEBy default everything Othor stores lives in AWS eu-north-1 (Stockholm). Analysis may be processed by your configured model provider, which can sit outside that region unless you bring your own model or self-host. Enterprise customers can request a different region — talk to your point of contact.
Encryption
IN PLACETLS 1.2 or higher in transit, AES-256 at rest via AWS. Credentials are encrypted and never shown back in cleartext.
Access
IN PLACEOrganisation admin and member roles plus per-agent sharing, Google sign-in, and workspace-scoped isolation. Our own staff access is least-privilege, logged and reviewed; access is revoked the day someone leaves.
Monitoring and response
IN PLACECentralised logging with alerting on anomalous activity, and a documented incident response plan with named owners. If a personal-data breach affects you, we notify you without delay, and report to the Data Protection Board of India within the timelines the DPDP Act requires.
Engineering practice
IN PLACEPeer-reviewed changes, automated dependency and vulnerability scanning, separated environments, encrypted backups with documented restore procedures, and vendor review before adoption.
Sub-processors
ON REQUESTWe'll send the current list covering infrastructure, model providers, payments and support tooling. A published list ships with our SOC 2 report.
SSO, audit log, pen test
ON ROADMAPSAML and OIDC single sign-on and a customer-facing workspace audit log are in development. An independent penetration test is planned ahead of our SOC 2 report, with a summary available under NDA.
Compliance
Where we actually stand.
Rather than imply more than we've earned, here's the precise state of each item — including the ones that are months away.
DPDP Act, 2023
CompliantMost of what Othor processes is business data, not personal data. Where personal data is involved, we comply with India's DPDP Act. See the Privacy Policy.
DPA
AvailableCovering processing scope, sub-processors, security measures and breach notification.
DPDP Act, 2023
Not heldNot in progress. We'll revisit once the SOC 2 report is issued.
HIPAA
Not supportedWe don't sign BAAs. Please don't connect sources containing PHI.
Bring us your hardest security question.
You'll get a straight answer in writing, including where the answer is "not yet". Report a suspected vulnerability to security@othor.ai and we'll acknowledge it within one business day.