Contact our Team

Platform · Security

Security by design. Protection at every layer.

The agentic AI platform for multilingual content in regulated industries. Enterprise-grade security controls protect your data across every layer of its flow.

Book a demo

Enterprise security

Built for regulated content.

Regular internal and external penetration testing assesses our backend infrastructure. Every client's data is logically segregated, access is scoped to their organization, and all LLM requests are routed exclusively over secured connections.

AI & client data · A zero-training commitment

0%

of your content is ever used to train or fine-tune a model.

Prompts and metadata are processed transiently to return your translation and are not retained by our model vendors. You set the data-retention policy for your organization, down to zero.

How we protect your data

Defense in depth, across every layer.

Controls span the network, identity, data and monitoring layers, so a single failure is never a single point of exposure.

  • 01 · Network & infrastructure

    Security by design

    Protection is engineered into every layer of the data flow, not bolted on afterward.

    • Internal and external penetration testing
    • Client data segregated and access-scoped
    • LLM requests over secured connections only
    • Network segregation and access restriction
  • 02 · AI & client data

    Your data stays yours

    Your content is used to serve you, and for nothing else.

    • Never used to train or fine-tune any model
    • Processed transiently for your translation
    • Prompts and metadata never retained
    • You control data retention, down to zero
  • 03 · Access control

    Authentication & authorization

    Access is granted narrowly, verified strongly, and never shared.

    • Least-privilege role-based access control
    • Multi-factor authentication enforced
    • API keys and tokens stored securely
  • 04 · Audit & monitoring

    Logged & reviewable

    Every action leaves a record that can be independently reviewed, at any time.

    • Every access event and API call is logged
    • Full logs are reviewable on demand
    • Regular privileged-access reviews
Encryption everywhere
  • TLS 1.2 / 1.3Data in transit. Encryption, authentication and message integrity on every connection.
  • AES-256Data at rest. Contents, databases and backups are all encrypted.
Certifications & attestations

Independently assessed. Built on recognized frameworks.

  • SOC 2Independently assessedIndependent auditor's report on the design and implementation of security controls, covering Security, with Confidentiality and Availability in scope.
  • ISO/IEC 27001By designOur information security management system is designed following ISO/IEC 27001, organizing cybersecurity around Organization, People, Process and Technology.
  • NIST CSF 2.0By designThe NIST Cybersecurity Framework 2.0 is our reference model for control set and maturity tracking, mapped to its core functions per security best practices.
  • GDPR · Law 25 · PIPEDABy designDesigned following the EU GDPR, Quebec's Law 25 and Canada's PIPEDA to ensure data security, protection and privacy.

Certifications and attestations are maintained by TRSB, the parent organization behind OTTO, covering the infrastructure and controls on which OTTO operates.

Security by design. Proof by default.

Download the security overview

Data residency

OTTO runs where the data has to stay.

API-first, on-prem or private cloud, or as an orchestration layer over your own models.

  • Deployment

    On-prem or private cloud

    OTTO runs on-prem or in your private cloud, and your content stays in your environment.

  • Hosting

    A private server

    OTTO runs on a private server in an entirely secure online environment.

  • Public sector

    In-jurisdiction (data residency)

    A government-owned transport organization required data residency within its own jurisdiction as a non-negotiable condition.

Enterprise-grade security. Data residency. Auditability.

Backed by TRSB

Robust data security for a tough world.

At TRSB, you get robust data security that mitigates risk under the watchful eye of a complete in-house technology team.

All your work is performed in a highly secure environment carefully monitored and maintained by TRSB's IT specialists.

  • 01

    Audits and compliance

    Annual ISO 27001:2022 gap analysis ensures TRSB adheres to the strictest security standards. Independent third-party auditors also perform ongoing penetration tests with OSSTMM and OWASP.

  • 02

    Vulnerability management

    TRSB's vulnerability functionalities proactively scan for weaknesses in workflow systems so that potential risks are mitigated before they can affect your data.

  • 03

    Incident response management

    TRSB's robust incident response plan quickly manages and resolves security threats, minimizing impact on your sensitive data.

  • 04

    Disaster recovery and business continuity

    TRSB's business continuity plan is designed to keep you up and running even in the face of natural disasters, cybersecurity threats, or other disruptive incidents.

  • 05

    Redundant and highly available infrastructure

    TRSB's servers, networks, and software work seamlessly together to protect against system failure and keep your data secure and always available.

  • 06

    Remote hosting

    Two mirrored data centres miles apart add to TRSB's continuity planning by guaranteeing data availability and backup.

  • 07

    Software development lifecycle

    Security measures are integrated into every stage of TRSB's software development lifecycle. Every tool is designed, coded, tested, and deployed with your data safety in mind.

  • 08

    Employee access

    Every new hire undergoes a background check and signs a confidentiality agreement, and Role-Based Access Control (RBAC) limits access to properly authorized employees. Access reviews are also performed quarterly to double-check all entitlements.

  • 09

    Data retention, protection and destruction

    It's your data, so you decide. TRSB keeps it safe until you ask for it to be destroyed.

FAQ

The questions your security team asks first.

Something specific to your security review? Talk to our team.

Is our content used to train AI models?

No. 0% of your content is ever used to train or fine-tune a model. Prompts and metadata are processed transiently to return your translation and are not retained by our model vendors.

How long is our data kept?

You set the data-retention policy for your organization, down to zero. Prompts and metadata are processed transiently and never retained.

Can OTTO run in our own environment?

Yes. OTTO runs on-prem or in your private cloud, and your content stays in your environment. A government-owned transport organization required data residency within its own jurisdiction as a non-negotiable condition. OTTO runs where the data has to stay.

How is our data protected?

Every client's data is logically segregated, access is scoped to their organization, and all LLM requests are routed exclusively over secured connections. Data is encrypted in transit (TLS 1.2 / 1.3) and at rest (AES-256), and regular internal and external penetration testing assesses our backend infrastructure.

Who can access our content?

Access is granted narrowly, verified strongly, and never shared: least-privilege role-based access control, enforced multi-factor authentication, and regular privileged-access reviews. At TRSB, every new hire undergoes a background check and signs a confidentiality agreement, and access reviews are performed quarterly.

Which security certifications apply?

SOC 2: an independent auditor's report on the design and implementation of security controls, covering Security, with Confidentiality and Availability in scope. ISO/IEC 27001, NIST CSF 2.0, GDPR, Quebec's Law 25 and PIPEDA: our controls are designed following each framework. Certifications and attestations are maintained by TRSB, the parent organization behind OTTO, covering the infrastructure and controls on which OTTO operates.

How is each decision audited?

Every recommendation is logged with its reason. Every output is scored with a stated reason. Every access event and API call is logged, and full logs are reviewable on demand.

How is OTTO different from free online translation tools?

Online software is fine for personal use but risky in a business context: it offers no guarantees of confidentiality and actually uses your content to build its database. OTTO runs on a private server in an entirely secure online environment.

Go further