Approval Queue
Review customer messages, publishing actions, purchase requests, billing steps and other external actions before they happen.
Security
Automation without losing control.
Ottili ONE is designed with security first. Approvals, permissions, audit trails, company isolation and a single-gateway architecture — all built in from the start, not added later.
Control and trust
What keeps your business data safe.
Roles & Permissions
Control who can access company data, modules, automations and settings.
Audit Trail
Keep important actions, workflow results and AI decisions traceable.
Feature Flags
Roll out modules and automation features carefully instead of breaking everything at once.
Platform Health
Monitor services, integrations, modules and system health from one platform view.
Technical security
Under the hood.
These are the technical security mechanisms built into the Ottili ONE platform.
JWT authentication
Secure JWT access tokens with refresh token rotation. Revoked tokens trigger session invalidation. Refresh tokens are rotated on each use and reuse is detected and rejected.
Argon2id password hashing
All passwords are hashed with Argon2id — the current industry standard for password security. Passwords are never stored in plaintext.
Rate limiting
Redis-backed rate limiting mitigates brute-force attacks. Throttling is enforced across instances.
Company data isolation
Every record is scoped to your company workspace. Cross-company access requires explicit, audited operations.
Single gateway access
External requests are routed through one authenticated API gateway. Internal services are not directly exposed to the public internet by design.
Append-only audit log
Every state-changing action is written to append-only, tamper-evident audit logs. Records are traceable and protected.
Certification & compliance
What we hold, and what we're working toward
We are transparent about our certifications. Everything below comes from our canonical registry — what we hold, what is planned, and what we do not claim. We never present a certification we have not earned.
- ReferencedGDPR (EU data protection)Processing of EU personal data across Ottili ONE.
Ottili ONE is built for GDPR: data-subject rights, lawful bases, retention limits and sub-processor transparency are implemented and referenced throughout the privacy surface.
Last reviewed: 2026-07 - PlannedSOC 2 Type IISecurity, availability and confidentiality controls.
A SOC 2 Type II audit is on our compliance roadmap. No attestation has been completed yet; we do not claim SOC 2 certification.
- PlannedISO/IEC 27001Information security management system.
ISO/IEC 27001 alignment is planned. Ottili is not yet certified; we do not claim ISO/IEC 27001 certification.
- Not heldISO/IEC 27017Cloud security controls for personal data.
Not currently pursued; we do not claim this certification.
Learn more
How companies, teams and permissions work.
Get started today
Ready to build your business on Ottili ONE?
Connect your tools, automate your daily work and keep control of every important action — all from one unified platform.
No credit card required. Start free and expand with modules.