Security and data protection
Only your company's team and the consultant assigned to your company can read your answers. Our operations staff see where an assessment stands, never what you answered. Messages with your consultant and your consultant's notes are encrypted field by field. Every staff account uses two-step sign-in, and your workspace keeps a full history of who did what.
Your assessments describe how your company uses AI and personal data. This page sets out how the Oblioria platform protects that information, and how to report a security problem.
How do I report a security problem?Who can see your answers?
| Who | Answers | Report | Status |
|---|---|---|---|
| Your team | Yes | Yes | Yes |
| Your consultant | Yes | Yes | Yes |
| Oblioria operations | No | No | Yes |
| Other Oblioria staff | No | No | No |
- Inside Oblioria, only the members of your company's workspace and the consultant assigned to your company can read your answers.
- Our operations staff can see where an assessment stands and who is responsible for it. They never see your answers or your report. Other staff roles cannot open your assessments at all.
- A consultant can read your answers only while assigned to your company. The check runs again on every request.
- Each company's data is kept apart. A request for another company's data gets the same "not found" answer as a request for something that does not exist.
- Supporting documents you upload follow the same access rules as your answers. They stay private, are checked for malware and are frozen with your submission.
- Your administrators decide who joins your workspace. Invitation links expire, and we store only a hash of each link's secret token.
How do people sign in?
- Accounts are by invitation only. There is no open sign-up.
- Passwords must be at least 12 characters. We store them only as one-way hashes.
- Accounts on your team can use two-step sign-in with an authenticator app.
- After five failed sign-in attempts in a minute, further attempts for that account from that address are paused.
- Sessions are stored on our servers and end after a set period of inactivity. "Remember me" sign-ins are tracked on our side, so we can revoke them. Changing your password ends them.
- We do not accept temporary, disposable email addresses for accounts.
How is Oblioria staff access controlled?
- Every Oblioria staff account must use two-step verification with an authenticator app, at every new session.
- Sensitive administrative actions, such as granting administrator rights or resetting someone's two-step sign-in, need a code entered in the last 15 minutes.
- Staff permissions come in four separate roles. Each person holds only the roles their job needs, and every change to staff access is recorded with a reason.
What is encrypted?
We encrypt these fields in our database with Halite, a library built on libsodium:
- messages between your team and your consultant
- your consultant's internal notes and reasons
- the IP address and the full browser string we record with sessions, submissions and security events
- the secrets behind staff two-step sign-in
- the details of security events
- The encryption key is kept outside the database.
- An automated test writes each of these fields and fails if any of them is stored as plain text.
- All connections to the app use HTTPS.
Which records can nobody change?
- Your answers are saved as revisions. A change adds a new revision, and earlier ones are kept.
- When you submit, we store a fixed copy of the submission with a SHA-256 checksum, and you get a receipt.
- A released report is a fixed snapshot with its own SHA-256 checksum and reference number. Nobody can edit or withdraw it.
- Each assessment has a history your team can read. We also keep an append-only record of changes to your workspace and who has access to it.
What do our emails and notifications show?
- Our emails about assessments name no company, AI system or person. They ask you to sign in to see the details.
- Live updates in the app go only to the signed-in person they are for, on a private channel.
- Our web server logs remove sign-in credentials, tokens and email addresses from the requests they record.
- Links that carry a secret, such as invitations and password resets, are not passed on to other websites.
How else is the app protected?
- Every part of our API requires sign-in unless it is meant to be public, such as signing in or accepting an invitation.
- Keys and passwords for our database, storage and other services stay on our servers. They are never sent to your browser.
- We keep backups of the production database, with point-in-time recovery.
Can you export or delete our data?
Yes. On request, we export or delete your company's data. Write to privacy@oblioria.com.
How do I report a security problem?
If you think you have found a vulnerability in oblioria.com or the Oblioria app, email security@oblioria.com. Our security contact details are also published at /.well-known/security.txt.
Please tell us what you found and how to reproduce it. When you test:
- use only accounts and data that belong to you
- do not access, change or keep other people's data
- do not run denial-of-service tests, send spam or try social engineering
- give us reasonable time to fix the problem before you share it publicly
We don't run a bug bounty program at the moment. We thank everyone who reports a problem responsibly.