Security and Responsible Disclosure

How your data is protected

Documents are stored privately and are never publicly addressable. Access is granted per request through short-lived links. Your records are separated from every other account at the database level, and browsers cannot write document records directly.

No security measure is perfect and we do not claim certification of any kind.

Reporting a vulnerability

Please report suspected vulnerabilities privately before disclosing them publicly. Security contact: security@optruva.com.

Please do not access, modify or delete data belonging to anyone else while testing, and do not run activity that degrades the service for others.

What we will do

We will acknowledge a good-faith report, investigate, and tell you the outcome. Formal response times and any safe-harbour commitment require legal review.