How we look after your data

Everything between your devices, your computers and Octopus Prime is encrypted in transit with TLS.

MongoDB Atlas keeps our database and its backups encrypted at rest. Cloudflare keeps the files you upload encrypted at rest, in private storage; the app shows them through links that expire within an hour.

On top of that, our servers encrypt the AI provider keys you add and your two-step login secrets before saving them, and keep only a fingerprint of each sign-in key, never the key itself.

Anything you put in the Vault is sealed on your own device before it leaves it. Our servers keep only the sealed copy, never the value, so we can't read it.

An agent you allow to use a Vault item can use it without seeing the value. Showing a value again needs your two-step login code.

People join an organization only by invitation, with one of four roles: Owner, Admin, Manager and Member. There are no passwords to leak: everyone signs in with Apple or Google.

Two-step login works on every account, and Owners and Admins can require it for the whole organization. You get 10 backup codes, and you can see and sign out every device that is signed in to your account.

Private conversations stay private: access follows membership, not rank. Your agents run on computers you connect, not ours, and whoever runs a computer can see what is sent to the agents on it. More on our security page.

We share data only with these services, and only what each needs for its part. They may use it only to provide their service to us. The full detail is in our Privacy Policy.

• Render: hosts the web app and our servers
• MongoDB Atlas: stores our database and its backups
• Cloudflare: stores the files you upload, share or keep in project folders, in private storage
• Stripe: takes payments on the web; card details go to Stripe, never to us
• Apple and Google: sign you in when you choose them
• Expo and Apple: deliver phone notifications if you turn them on
• Your browser's maker: delivers browser notifications if you turn them on, receiving only an encrypted notification
• SiteGround: delivers the emails we send, such as invitations
• Google Cloud: turns a message into speech when you play it with a Premium or Standard voice
• Google Analytics: counts visits to the web app, only if you accept analytics cookies
• RingCentral: delivers text messages when you text our support number
• Anthropic: provides AI tools our team uses to sort the bug reports you send and to help fix bugs
• The AI providers you choose: answer your AI conversations under your own or your organization's account and key, and their own terms

On this website only, and only with your consent where noted:

• Google Analytics: counts visits, only if you accept analytics cookies
• X and Reddit: measure our ads, only if you accept advertising cookies
• Web3Forms: forwards the support form on this website to our email

Octopus Prime doesn't hold a security certification of its own. Our hosting, database, storage and payment providers each publish their own security and compliance reports, which cover their services, not ours:

• Render
• MongoDB Atlas
• Cloudflare
• Stripe
• Google Cloud

Email support@octopusprimeai.com with "Security" in the subject. Tell us what you found, how to reproduce it and what it could affect. Please don't access other people's data, and give us a chance to fix it before telling anyone else.

The rules for testing and reporting are in our vulnerability disclosure policy, and our contact details for researchers are in security.txt.