Your data is yours. Here is how we treat it.

Ownership

Client data ownership, permitted use, export formats, retention and deletion must be recorded in the agreement. Any AI provider and its data terms require review before client information is connected.

Isolation

The current Studio is an owner-only workspace. Client accounts, role-based access and a client portal are not active. A multi-client deployment requires an agreed isolation design and authorization tests before access is expanded.

Access

Studio currently has owner access; multi-factor authentication and additional roles remain open work. Client delivery requires named users, a reviewed access matrix, protected credentials and an offboarding procedure appropriate to the systems involved.

Backups and restores

The current recovery provision is a local backup encrypted with Windows DPAPI. Offsite backup and a documented recovery test in an independent environment remain open requirements; local encryption alone does not establish disaster recovery.

What the AI may do alone

Approval boundaries are defined per workflow. A demonstration may show drafting or routing, but production actions need approved accounts, permissions, logging and a recovery path. Financial, employment and other binding decisions require an explicitly agreed human approval step.

Calls and recordings

Opralta has no activated production calling or calendar workflow today. Before a voice implementation is enabled, the client and delivery team must agree disclosures, consent handling, recording access, retention and provider settings.

Payments

Payment connections are project-specific. Provider approval, payment-data handling, test mode, reconciliation and launch authorization must be verified before activation. The public demonstrations do not process payments.

Vendors

The providers, regions, data flows and retention settings for each engagement must be listed and reviewed before connection. An offered integration is not evidence that its provider account or service is active.

Incidents

An incident process needs a named owner, a monitored reporting route and an agreed escalation plan. We do not currently advertise a staffed round-the-clock response or a guaranteed response interval.

Reporting a vulnerability

Report a potential vulnerability through the contact form, with a description and steps to reproduce it. Do not send credentials or other people's data. We have not established a paid bounty, a guaranteed acknowledgement time or a formal security testing authorization through this page.

Questions

Send a security or procurement question through the contact form. Requests are captured for owner review; a submission does not confirm a reply or meeting.