Security and data handling

In short

• Ocita runs on Cloudflare, with a Postgres database hosted by PlanetScale.
• Your prompts go to cloro, our data provider, to get the engines' answers, with the country you set. It doesn't get your name or email address.
• Raw answer text is deleted after 13 months.
• Sign-in is by email link or Google, so accounts have no passwords to leak.
• Every workspace's data is kept apart, and every API route checks which workspace you belong to.
• Ocita has no SOC 2 or ISO 27001 certification and hasn't had a penetration test. We say so rather than imply otherwise.

What we collect, why, and your rights over it are in our Privacy Policy.

Where your data lives

The site, app and API run on Cloudflare Workers. Account details, workspaces, brands, prompts, competitors, scores and citations are in a Postgres database hosted by PlanetScale and reached through Cloudflare Hyperdrive. The full text of each answer, uploaded logos and generated report PDFs are in Cloudflare R2 storage.

Cloudflare runs Workers in many locations around the world, close to whoever is making the request. The region for the database and storage is chosen when production is set up, and we'll list it here once it is.

All traffic uses HTTPS, and browsers are told to use nothing else for a year (HSTS). Pages send a strict Content Security Policy and can't be framed by other sites. For encryption of stored data, we rely on what each provider documents in its own documentation, linked below.

Subprocessors

These are the services that handle customer data on Ocita's behalf.

What we keep, and for how long

• Raw answers: the full text of every answer, kept 13 months and then deleted by a daily job.
• Scores, mentions and citations: kept for as long as the brand exists, so your history stays readable.
• Account and workspace details: your name, email address, profile photo if you sign in with Google, your workspace's brands, prompts, competitors, branding and team. Kept until you delete them.
• Abuse limits: short-lived counters keyed by IP address or email address, deleted daily once their window has passed.
• Public site: sets no cookies. If analytics is on, it keeps where your visit came from in your browser tab (sessionStorage) until you sign up or close the tab, with no id.

Signing in

• Email link: works once and expires after 15 minutes.
• Google: if you choose it, Google confirms who you are. Ocita never sees your Google password.
• Sessions last 7 days, and a daily job deletes expired ones, with the IP address and browser they recorded. Changing your email address needs confirmation from the old address and verification of the new one.
• SSO and SAML aren't available.

Workspaces and roles

Every row of workspace data carries its workspace, and every API route checks that you're a member of that workspace before it reads or changes anything. An automated test runs each route that takes an id against another workspace's data and expects a refusal.

• Owner: billing and plan, deleting brands, plus everything an Admin can do.
• Admin: invites, adding and assigning brands, branding, and answer budgets.
• Member: sees and edits only the brands assigned to them, and can share their reports.
• Viewer: sees the brands assigned to them and their reports, without changing anything.

There's no audit log yet.

Shared reports

A shared report opens from a random link, without an account. You can add a password, which is stored only as a salted PBKDF2-SHA256 hash, set an expiry date, choose whether PDF and CSV downloads are allowed, and revoke the link at any time.

Abuse and spending limits

Public and sign-in routes are limited, counted in the database so the limits hold across every Cloudflare location:

• Sign-in and verification emails: 5 an hour to one address, and 20 an hour from one IP address.
• Wrong report passwords: 10 every 15 minutes on one link from one IP address, and 50 an hour on one link in total.
• Team invites: 30 an hour per workspace.
• New workspaces: 5 a day from one IP address.
• Free AI crawler checker: 20 an hour from one IP address, and 1000 an hour in total.

A global spending guard stops new runs once a daily spending limit on engine calls is reached, and a pause switch stops all new runs at once. Each brand also has its own monthly answer allowance.

Deleting your data

• Your account: delete it from Account in the app. You're removed from every workspace, and a workspace where you're the only member is deleted with you. If you're the only Owner of a workspace with other members, you'll be asked to make someone else Owner first.
• A workspace: an Owner can delete it from Team in the app, typing its name to confirm. Its brands, history, reports, shared links and team access go, and its subscription is canceled first.
• A brand: an Owner can delete it, with its history, from Brand settings.
• Files in storage: deleting a brand, a workspace or your account also removes its files in R2: the full answer texts, report PDFs, and the uploaded logo and photo. The list of what to remove is saved with the delete, and the files usually go within minutes; a very large workspace can take a few hours. An uploaded image that another workspace still shows as its logo stays until it's no longer used. Replacing a logo or photo removes the old file the same way.

What we don't have yet

• No SOC 2, ISO 27001 or other certification.
• No independent penetration test. Whether to commission one or a lighter review is still being decided.
• No SSO, SAML or audit log.
• A data processing agreement is planned and isn't available yet.

Our providers publish their own certifications on the pages linked above. Theirs aren't ours.

Report a vulnerability

Email security@ocita.ai. Please give us a reasonable chance to fix a problem before you share it, and don't access other people's data, disrupt the service or run automated scans that send heavy traffic. We'll reply, keep you updated and credit you if you'd like. There's no paid bug bounty. Our security.txt has the same details.