Transport and browser boundaries
The site uses HTTPS, a content security policy and anti-framing headers. Camera and geolocation access are disabled. The Operator’s microphone access requires a separate consent and recording action.
Enterprise review
Security starts with the workflow.
And a documented boundary.
Otomat builds custom AI systems through scoped engagements. This page explains how our public website handles information and the security requirements we define with enterprise clients before deployment.
Reviewed · Public website and enterprise engagement scope
Controls on the public website
AI requests through our server
Provider credentials stay on the server. The Operator checks request origin, session validity and usage limits before processing a question. Answers use a reviewed public knowledge snapshot; visitor conversations do not automatically update it.
Scoped, temporary conversations
Operator sessions expire 30 minutes after creation. Conversation context is held in server memory and removed by periodic expiry cleanup or a successful close or clear request. It is not stored in an application database or application logs. If a close or clear request fails, context can remain until expiry cleanup.
Public planning only
The Operator has no document-upload feature. Keep patient records, credentials, customer records and confidential deal material out of public chat and contact forms. Input checks can interrupt sensitive content, but they do not make a public form an approved channel for restricted data.
Where website information goes
Questions and optional voice
Our server sends questions and recent conversation context to OpenAI. Optional recordings go to OpenAI for transcription; you can edit the transcript before sending it. Google Cloud Text-to-Speech generates playback from the displayed answer. The application does not retain raw recordings in storage. Provider policies govern their processing; we do not promise zero provider retention or a particular processing region.
Contact requests
A submitted Return Review request is stored in Otomat’s Google Cloud Firestore queue for follow-up. You review the information before submitting. Sending a request does not subscribe you to marketing. Request records are retained while handling the inquiry and any resulting engagement, and as otherwise needed under the Privacy Policy; there is no fixed automatic deletion period published for these records.
Analytics and abuse prevention
Application analytics exclude question text and transcripts. Abuse-prevention counters use a salted network-address hash; infrastructure may keep ordinary request metadata. These operational records are distinct from conversation content.
Security requirements for client deployments
Client systems have their own architecture, permissions, data and operating owners. We agree the controls and evidence for that environment in the engagement scope. Public-website controls are not an attestation for a client deployment.
Data and providers
Agree permitted data, processing purposes, model providers, hosting region, retention and deletion before connecting client systems. Document required processing agreements and third-party dependencies.
Identity and access
Define roles, tenant boundaries and permitted actions. Test an authorized task alongside denied access, cross-tenant requests and attempted data disclosure.
Evaluation and release
Set acceptance tasks and quality, cost and risk thresholds. Review changes before production, retain the decision record and define a rollback path. Feedback does not authorize its own release.
Operation and recovery
Name the operating owner and backup, support hours, escalation contacts and recovery responsibilities. Include runbooks, a restore exercise and handover acceptance in the agreed scope.
Before release, the client reviews the agreed acceptance evidence and any unresolved risks. Engineering completion, passing tests, deployment and client acceptance are recorded separately.
Inspect the service scopes and acceptance requirements →Compliance and independent assurance
Security and regulatory requirements depend on the data, workflow, jurisdiction and deployment. Bring your security questionnaire, data-processing requirements and required assurance reports into scoping so the business, IT, security and legal owners can decide what is required before access is granted.
This page does not claim SOC 2 attestation, ISO 27001 certification, HIPAA compliance or an independent penetration-test result. Where required, processing agreements, business-associate agreements, regional hosting, independent testing and service-level commitments must be confirmed for the specific engagement. They are not implied by work in a regulated sector.
Our evidence library separates client-reported work, inspected source documentation and unresolved acceptance. A documented control or passing application test is not an independent certification.
Bring your requirements into the first review.
Describe the system, data categories, required controls and decision owners. We can then scope the work, evidence and specialist review your organization needs.
Discuss enterprise requirementsFor a security concern or privacy request, contact adam@otomat.ai. Describe the issue without sending credentials, sensitive records or exploit payloads. This contact does not imply a 24/7 response commitment.