Security
Join the future. Bring the evidence.
Your firm wants what AI makes possible. Your examiner wants evidence — Otto is built to hand it over.
Nothing to patch.
There is no server anyone can neglect — no VM, no container, no SSH. The runtime is Cloudflare's.
Static assets + Workers · TLS 1.2 floor · HSTS preload
The gate can't be talked into anything.
The part that blocks a call is a rule, not a model. Deterministic — and it shows its work.
Consent, quiet hours, frequency & SCRA holds, checked before the dial · every block recorded
Transcripts expire. On schedule.
Call records sweep at 90 days. Consent records outlive them on purpose — TCPA claims run four years.
90-day sweep · consent records retained 1,600 days
Your archive never leaves the building.
Otto Redact swaps identifiers for tokens on your own hardware. The model reasons about [SSN-1]; only your screen resolves it.
On-device tokenization · the reversible map stays with you
One door, and we watch it.
The site answers on a single origin, and the security contact reaches a real inbox.
workers.dev off · security.txt (RFC 9116) · Entra sign-in with MFA
In audit. Said plainly.
When a report issues, this page will say so — and not a day before.
- SOC 2 Type II
- In audit
- ISO 27001
- In audit
- PCI DSS
- Out of scope — card data never enters Otto
For your diligence team.
The full control inventory is written to be handed to an auditor — ask, through the contact page. The public half you can check yourself:
dig TXT _dmarc.ottoforfirms.com · dig DS ottoforfirms.com · curl https://ottoforfirms.com/.well-known/security.txt
Read next
- The bank third-party-risk questionnaire, question by question
- What a collections firm's audit file should contain
- The data processing addendum
Otto is a technology provider, not a law firm: these are controls, and whether they satisfy an obligation is your counsel’s call, not ours. The compliance engine ships all fifty states, configured; the demo shows four of them in end-to-end depth.
This page describes Otto, not the law, and is not legal advice. Otto applies rules that have been written down correctly; it does not warrant that using it results in compliance with any statute, regulation or contract. Where a rule is named here, confirm it against the primary source and your own counsel before relying on it.