Security

A plain-language answer to what buyers ask first.

This page describes what Otium actually does with your data today. It is not a compliance certification. We are not currently SOC 2 certified, and nothing here should be read as one.

Data handling

Application data is stored in Supabase (Postgres). All traffic to and from the database runs over TLS, and data is encrypted at rest. Every table that holds a customer’s data has row-level security policies enforced by the database itself, not just by application code. A request that doesn’t belong to your account cannot read your rows, even if a bug elsewhere in the app forgets to filter by account.

Authentication

Sign-in and account management run through Clerk. We never see or store your password. Session tokens are short-lived and verified on every request.

Tenant isolation

Every query is scoped to the signed-in user’s account and team by database-level row-level security policies. One customer’s team never sees another customer’s data. This is enforced at the same layer that stores the data, not by a trust assumption in application code.

What goes to AI providers, and what doesn’t

When you talk with your AI coach, your messages are sent to Anthropic (and in some cases OpenAI) to generate a response. By default, neither provider trains its models on data sent through their API, and we have not opted in to any training program.

Before anything is logged, a review step scrubs personally identifiable information out of what the coach reads and writes on your behalf. When the coach connects to an external tool or system, it requests read-only access wherever that’s possible, and whatever it retrieves or produces is written back into rows scoped to your own workspace, not shared across customers.

Data deletion on request

Email nicholas@otium.so to delete your account. We remove your account and associated data within 30 days. Full detail on what we collect, how long we keep it, and your rights over it is in our Privacy Policy.

Questions

If you have a security question ahead of a purchase, or you want to report an issue, email nicholas@otium.so. We respond within two business days.