Security

Account & Data Security

How Ottili ONE protects your account and business data: authentication, sessions, tenant isolation, audit logs, brute-force protection, and how to report a vulnerability.

Ottili ONE is built security-first. This guide explains what the platform does to protect your account and your company's data, and what you can do to keep your workspace safe.

All account, login, and session controls live on the dashboard at [dashboard.ottili.one](https://dashboard.ottili.one). For the step-by-step actions (creating an account, enabling passkeys, resetting a password, recovering access), see [Account and Login](/docs/account-and-login).

What Ottili does for you

Authentication and sessions

Sign-in uses secure JWT access tokens with refresh-token rotation*. When a token is revoked, the entire session is invalidated — a stolen token cannot be reused.
Sessions expire after an idle timeout and an absolute maximum lifetime (both configurable by your organization). See [Account and Login → Session Management](/docs/account-and-login) for the user-facing behavior.
Passwords are hashed with Argon2id*, the current industry standard for password hashing. Ottili never stores passwords in plaintext.
You can sign in with email and password, Google, Microsoft, or a connected Ottili SSO product. Where enabled, passkeys (WebAuthn)* and multi-factor authentication (TOTP)* add a second verification step.

Tenant isolation

Every business object in Ottili ONE belongs to a company workspace*. Data is isolated per company at the platform level, and the platform gateway is designed so that no cross-company data leakage is architecturally possible. A run, integration, or API call can only reach what your role and company permit.

Single gateway access

All external requests go through one authenticated API gateway. Internal services are not reachable from outside the platform network. This is the same boundary that protects the public website, the dashboard, and the product APIs.

Rate limiting and brute-force protection

Rate limiting (Redis-backed) slows down credential guessing and abuse.
Repeated failed logins trigger an account lockout that is persisted in the database*, not just held in memory, so protection survives restarts.
Unusual sign-in locations or patterns can require extra verification.

Audit trail

Every state-changing action is written to an append-only audit log*. Audit records cannot be modified or deleted, which gives you a trustworthy history of who did what and when — useful for reviews, incident response, and compliance.

What you should do

Use a strong, unique password (see [password requirements](/docs/account-and-login)).
Enable multi-factor authentication or register a passkey where your workspace allows it.
Sign out on shared or public computers, and use Sign out all devices* if you suspect unauthorized access.
Review active sessions and connected devices under Account → Sessions* in your dashboard.
Treat any message that asks for your Ottili password by email or phone as suspicious — Ottili will never ask for your password.

Phishing-resistant passkeys are bound to dashboard.ottili.one and cannot be reused on a fake site. Prefer them wherever available.

Reporting a vulnerability

If you find a security issue in Ottili ONE, Ottili Coder, LD3, or another Ottili product:

1. Do not disclose the issue publicly until it is fixed.

2. Report it through the responsible-disclosure channel on the [Security overview](/security) page, or contact support from your dashboard help menu.

3. Include steps to reproduce, affected area, and impact where possible.

We review reports and coordinate a fix and disclosure timeline. Responsible disclosure helps keep every Ottili customer safe.

Certifications and compliance

Ottili maintains the platform security controls described above as part of ongoing operations. For the current status of independent certifications, sub-processors, and the data-processing agreement, see the [Security overview](/security) page and the legal pages linked from the footer. Claims that are not yet verified are not presented as certified.