Security by mechanism, with plain words on what exists.
The four mechanisms below run in the product today. What does not exist yet (certifications, figures) is stated outright instead of left for you to ask.
- Access checked before reading
- Write actions approved, with a log
- No certifications yet, stated outright
Four mechanisms that run today.
This is the section your IT team will read most closely, so each point below is a mechanism that really exists in the product, not a slogan.
Access checked before reading
Who sees which document is your decision, not the model's. When unsure, the system refuses instead of guessing.
Write actions approved, with a log
Every change to your data waits for a person to approve, and it is all recorded: who asked, who approved, when.
Budget limits and an emergency stop
Model spend per workspace has a clear limit; past it, the system stops itself instead of running on.
Input filtering against prompt injection
Every question and document passes input filtering before reaching the model, so stray instructions in a file never become actions.
Where your data goes.
Small and mid-sized teams use the shared platform: data is separated per organization, and access is checked before any document is read.
Larger enterprises get a dedicated deployment, on your infrastructure or in your VPC, deployed on request. Data stays on your infrastructure only when you use a self-hosted AI model.
Models run through Google Vertex or AWS Bedrock. OPTIMO doesn't depend on one provider. We publish no training policy yet, because that depends on each provider's terms.
Access and organizations
Who sees what is your call.
Separated per organization, blocked for outsiders by default.
Data separated per organization
Each organization sees exactly its own documents. Change the permission at the source and the answer scope follows.
Outside partners blocked by default
Partner accounts reach only what is opened to them, never the internal paths on their own.
Every access leaves a trace
Who read what, asked what, approved what: all logged for when you need to check.
Deployment
Use it right away, or deploy it privately.
One product, two ways to deploy it. Choose by your size and your data requirements.
Shared platform for small and mid-sized teams
Start right away with no infrastructure of your own. Data is separated per organization, and access is checked before any document is read.
Dedicated deployment for larger enterprises
A dedicated system per customer, on your infrastructure or in your VPC, deployed on request. Data stays on your infrastructure only when you use a self-hosted AI model.
Optimo Desktop: data on deviceIn development
The agent works directly on the user's machine.
Certifications and compliance
An honest status board.
What exists is marked so; what doesn't is marked so.
- Access checked before reading (fail-closed)
- Approval for write actions and an audit trail
- Data separated per organization
- Input filtering against prompt injection
- SOC 2 certification
- ISO 27001 certification
Report a vulnerability
Found something off? Tell us.
If you find a security hole in OPTIMO, we want to hear it directly before it becomes an incident.
[PLACEHOLDER] security@optimo.example
Want your IT team to review it with us?
We will walk through the deployment architecture, the permission model and the audit log in one technical session.