This page is maintained by the Othen team to answer common security and privacy questions about how the product handles your data. It's a description of our current practices, not an independent certification.
Access and authentication
- Sign-in uses Google OAuth or a signed magic link. We don't store passwords.
- Sessions are scoped to your workspace and revocable from settings.
Data isolation
- Every table with user data uses row-level security scoped to your workspace.
- Test results and prompts are only visible to members of the workspace that created them.
- Public share links are opt-in per report and use unguessable slugs.
In transit and at rest
- All traffic is served over TLS.
- Database storage and backups are encrypted at rest.
- Secrets (like the keys used to sign requests to your app) are stored encrypted and never rendered back to the client after creation.
Connecting your app
- Othen calls the endpoint you configure. Requests are signed with an HMAC so your server can verify they came from us.
- You can rotate or revoke the signing key at any time.
- We recommend running tests against a staging environment, not production.
Third-party model providers
Test users, simulated conversations, and evaluations are produced by models from the OpenAI, Anthropic, and Google families, plus a search-grounded provider for fact-checking. We call these providers over their commercial APIs; their terms prohibit training on API content. We choose the smallest model that does the job for each step to reduce data exposure and cost.
What we don't do
- We don't tap into your production traffic.
- We don't use your prompts or transcripts to train foundation models.
- We don't sell data.
Reporting a vulnerability
If you think you've found a security issue, . We'll acknowledge within 2 business days and work with you in good faith. Please don't disclose publicly until we've had a chance to respond.