Administration and Security

Data retention

How Ottili ONE stores, backs up, exports and deletes your company data: company-scoped retention, encrypted backups, export and deletion (GDPR), audit logs and tenant isolation.

Overview

Ottili ONE stores your company's data strictly company-scoped: every business object belongs to a company, and the platform is built so that no cross-company data flow is architecturally possible. This article explains how Ottili ONE retains, secures, exports and deletes your data — and which controls your company can operate itself.

We distinguish clearly between Live, Beta, Private Beta, In Development, Planned and Concept. We flag verified statements accordingly and make no unverified claims about retention periods.

What data Ottili stores

Ottili ONE processes the data your company creates on or connects through the platform:

Business data:* leads, deals, quotes, orders, invoices, customers, inventory and purchasing (Business Hub), plus module data from LD3, Ottili Files, Flows, Coder, Messenger and other modules.
Account and security data:* hashed passwords (Argon2id), signed JWT session tokens, and role and permission assignments.
Log data:* append-only audit logs of security-relevant actions.
Backups and exports:* produced through the Backup and Data Export Center.

All of this data is bound to a verified company_id; access follows deny-by-default.

Company-scoped and isolated

Retention in Ottili ONE is as company-scoped as the rest of the platform:

Fail-closed:* the shared assert_same_company() function rejects any request without or with an incorrect company context.
Database row-level security (RLS):* queries are filtered by the verified company_id; the runtime default state is "deny".
No cross-tenant:* one company can never read or delete another company's data.

This means retention and deletion always affect only the correct tenant.

Encryption

Ottili ONE applies encrypted storage and transport (details in [Account and data security](/docs/account-and-data-security)):

Encryption at rest:* backups can be encrypted at rest with AES-256-GCM* when backup encryption is enabled and a passphrase is configured.
Transport (TLS):* service-to-service traffic verifies TLS/SSL certificates; outbound mail uses STARTTLS when enabled.
Passwords:* user passwords are hashed with Argon2id*; Ottili never stores plaintext passwords.

Backups

The Backup and Data Export Center* is the central hub for backing up your company data. It provides unified backup management across modules and services. Backup encryption (AES-256-GCM) is enabled through a configured passphrase.

How long backups are retained is determined by your company's configuration (the retention window of the backup jobs). Ottili ONE does not enforce a single, platform-wide fixed backup period.

Data export and deletion (GDPR)

Through the Backup and Data Export Center*, authorized company administrators can:

Export data* (e.g. CSV, JSON) — for portability or your own archiving.
Raise and track GDPR requests* for data export and deletion (right to data portability and right to erasure).

Every export- or deletion-related action produces a traceable audit event. Deletion is company-scoped and happens within the correct tenant boundary; it covers your company's data, not that of other tenants.

Audit logs and retention

Security-relevant actions are written to append-only audit logs* that cannot be changed or deleted afterwards. This gives you a trustworthy history for reviews, incident response and compliance. Audit logs are also strictly company-scoped.

Status and availability

Ottili ONE distinguishes clearly between Live, Beta, Private Beta, In Development, Planned and Concept. For data retention, currently:

Live:* company-scoped storage, tenant isolation, TLS transport and Argon2id password hashing are active parts of the platform.
Live:* the Backup and Data Export Center (backups, exports, GDPR data requests) is production-ready and available.
Live:* append-only audit logs are active; log entries are immutable.
Configuration-dependent:* the exact duration of backup retention follows your company's configuration; Ottili ONE does not publish a fixed, platform-wide period as a verified value.

We deliberately do not present any further, not-yet-verified features (e.g. fixed, legally mandated retention catalogs per module) as available. What the status terms mean in detail is described in [Understanding feature status labels](/docs/understand-feature-status-labels).

[Security overview](/docs/security-overview) — how the security architecture fits together.
[Audit logs](/docs/audit-logs) — traceable, company-scoped logs.
[Tenant isolation](/docs/tenant-isolation) — why your data stays isolated.
[Account and data security](/docs/account-and-data-security) — authentication, sessions, isolation.
[Secrets management](/docs/secrets-management) — how sensitive values are managed.
[Company, team & permissions](/docs/company-administration) — manage roles and access.
[Understanding feature status labels](/docs/understand-feature-status-labels) — what the status terms mean.

Was this article helpful?