Trust
The Ottom trust centre is where a security review of Ottom starts. It describes the controls that protect the data Ottom holds, shows how data moves between your team, our servers, the stores our AI agents visit and the services we use, and links the legal documents that bind us.
What protects your data today. Each point describes something that is running now, not a plan.
How our agents identify themselves, and how to opt a store out, is on our agent page.
Your team reaches Ottom over HTTPS. Our AI agents visit the stores you ask us to test, and the results are kept on our own servers in the United Kingdom.
The services outside Ottom that can see personal data we hold, as published on our subprocessors page (version 22 September 2026), where every change is recorded with its date.
| Service | What we use it for | Personal data it can see | Where |
|---|---|---|---|
| Anthropic | Runs the AI models our agents use to read and judge a storefront. | Storefront content: product details and shipping and returns policy text. We do not send account details or screenshots. | United States |
| Stripe | Takes card payments, sends invoices and calculates tax. | Billing name, email and address, and payment details, which never reach our servers. | United States and European Union |
| Resend | Sends our email and receives email sent to our support address. | Email addresses, the content of the email, and whether it was delivered, opened or clicked. | United States |
| Cloudflare | Sits in front of the website: domain names, caching, protection from attacks, and sign-in for our own staff tools. | IP addresses and the details of each request to the website. | Global network, United States company |
| Sentry | Tells us when the software fails, so we can fix it. | Technical details of the failure, which can include an internal account number. Request bodies, cookies, and your email and IP address are removed before sending. | United States |
| PostHog | Counts how the product is used, such as scans started and plans chosen. | An internal account number and the event. No email address, and no cookies. | European Union |
| Google Analytics, only if you allow it on the cookie notice, and Sign in with Google if you choose it. | For analytics, page visits with identifiers removed from addresses. For sign-in, your Google account email and name. | United States | |
| Slack | Tells our team when a customer starts a scan, a trial or a plan, or cancels one. | The customer email address and the store address. | United States |
How we handle personal data on your behalf, including security, subprocessors, transfers, breach notice and deletion, is set out in our Data Processing Agreement (version 28 September 2026). Every legal document we publish is on the legal page.
The database and the scan recordings are held on our own servers in the United Kingdom. Some of the services we use process data in other countries. The subprocessor list on this page says which services they are, what each one can see and where.
No. Card payments are taken by Stripe, and card details never reach our servers.
Only the people who run the service and answer support requests. Our admin tools need a password and a code from an authenticator app for every staff account, and every action taken in them is written to an audit log that cannot be edited or deleted.
Yes. The owner of a workspace can require every member to have a second factor. A member without one has no access to the workspace or its stores until they add one.
Every page and API is served over HTTPS. Passwords and recovery codes are kept only as hashes, the links we email are stored only as hashes, and the keys we hold for the services you connect are encrypted before they are stored.
Every server is backed up every three hours. Backups are encrypted before they leave the server, and a copy is kept off site.
Our Privacy Policy lists how long we keep each kind of data, and a nightly job deletes it when that period ends. You can ask us to erase your account at any time.
Every change is reviewed in a pull request and must pass automated tests. It then runs on a separate staging environment, and production is updated only when we promote a build already running there. Any release can be rolled back to the build before it.
Yes. They send a published user agent, leave from fixed published addresses, use a synthetic email address at checkout and never submit a payment. Our agent page gives the details and how to opt a store out.
Write to [email protected] with the word Security in the subject. A person replies within five working days. Our page on reporting a security problem gives the full policy.
If you find a security weakness in Ottom, our page on reporting a security problem says where to write, what to send and what we promise in return. Our Privacy Policy says what personal data we hold and for how long.