How we handle your team's data.

Where your data lives

otlta stores your data in a Supabase Postgres database. The database lives in Supabase's Mumbai (ap-south-1) region. Row-level security policies enforce that one organization can never read another's content directly from the database; every read goes through our Cloudflare Worker, which checks org + workspace membership on every request. The iOS and Android apps talk to that same Worker and get the same checks. On the device itself they keep your session token, two preferences (theme and last workspace open), a per-installation identifier Expo uses for update checks, and whatever the crash reporter has queued but not yet sent. So that the app can still be read without a signal, they also keep a copy of the workspace content you have loaded in the app: your name and email, the workspaces you belong to, your tasks and the tasks, comments, sprints, epics, notifications and digests shown on screens you have opened, the names and email addresses of fellow workspace members, and any reminder email address set on those tasks or on documents you have opened — which can belong to someone who has since left the workspace. For documents it keeps two things: the list of every document you can see in each workspace you have opened in the app — titles and details such as tags and dates, not their text — and the full text of the documents you have opened, private documents included. Search terms, Ask conversations and documents' public share links are not kept. The copy sits in the app's private storage, which other apps cannot read; otlta adds no encryption of its own on top of whatever the phone applies. It is deleted from the phone when you sign out, whether or not the phone has a signal, and when a different account signs in on that phone. Anything in it older than seven days is dropped the next time the app runs. An app update can also discard it, but does not always. iOS leaves it out of iCloud backups; on Android it can be included in the phone's Google backup, as the session token already can. A task created in the app with no signal is also kept there until it can be sent — its title, priority and due date, which workspace it is for, and when it was created — and is deleted from the phone once otlta has it. One that otlta refuses stays, with the reason shown, until you discard it. Unlike the copy above, unsent tasks are not deleted just because the app becomes signed out: they stay on the phone, under your account, until they are sent, you sign out from the app's Settings (which warns you first if any are still waiting, or if it cannot read what is waiting), you delete your account from the app's Settings, a different account signs in on that phone, or 30 days pass without you being signed in on that phone. If the phone's storage refuses one of those deletions from Settings, the app tells you. If the session ends some other way — you sign out on the web, which ends every session, or the phone's session expires or is rejected — the app shows and sends nothing while signed out, and sends them when the same account signs back in. A task that was still being saved at the moment the session ended is kept with them, or the app tells you it could not be. Unsent tasks are kept this way for up to 30 days after you were last signed in on this phone, counted from the last time the app was open with you signed in; once that has passed, they are deleted the next time the app is opened. So signing out on the web does not by itself remove them from a phone you no longer have: they go when someone else signs in on it, when the app is removed, or the first time the app is opened after the 30 days. If the account was deleted somewhere other than this phone, its unsent tasks stay in the app's storage on the same terms: until a different account signs in, the app is removed, or the app is opened after the 30 days. They are stored and backed up exactly like the copy above.

Encryption

All connections between otlta and your browser or the mobile apps use TLS 1.2 or higher. Data is encrypted at rest in Postgres using AES-256 (managed by Supabase). Backups are encrypted with the same key and retained for 30 days.

Access

Production database access is limited to two engineers, both with hardware MFA. Our Cloudflare Worker uses a service role key to write on your behalf — the key never leaves the Worker runtime. We don't run a customer-support tool that can impersonate users; the platform-admin route exists but requires a separate allowlisted account, and admin actions are recorded in an audit log.

AI

AI requests go through our internal gateway (Buddhi) to the AI model providers we use. Neither we nor they train models on your data. We pass your workspace content to the model only as context for the specific question you asked; otlta keeps no copy of it outside that request. Embeddings used for retrieval live in Postgres alongside your data and are deleted when the source document is deleted.

Sub-processors

• Supabase — Postgres, auth, storage
• Cloudflare — Workers, R2, KV, Hyperdrive, Pages
• Razorpay — payments
• AI model providers — AI inference, via our gateway
• Resend — transactional email
• Sentry — crash and error reports from the browser and the mobile apps, processed in its EU region. What a report contains is spelled out on the privacy page.
• Expo — over-the-air JavaScript updates for the mobile apps. It sees the update check — app version, platform, IP and a per-installation identifier — not your data.

Compliance roadmap

SOC 2 Type 1 audit window opens once we cross 50 paying customers. Type 2 follows. We'll publish the report on the trust portal at trust.otlta.com when it's ready.

Reporting

Found a security issue? Email security@otlta.com. We reply as quickly as we can — we're a small team, and we read it. We don't have a paid bug bounty yet but we will credit reporters publicly with permission.