Security at Optanik

Optanik can take control of your computers and holds your team's passwords, so we treat its security as part of yours. This page describes what is in place today, what we're working on, and how to reach us about a security issue.

Sign-in and access

• Two-factor sign-in is required for every user of Optanik, Optanik Support, Optanik Keyring and OptaMeet, with an authenticator app, email or Telegram codes. It can't be switched off.
• Single sign-on is available for Optanik Domain.
• Passwords are stored only as salted, slow hashes, and repeated failed sign-ins are rate limited.
• Workspaces are kept separate, and workspace owners control their users' roles.

Encryption

• All traffic to our sites and services uses HTTPS. TLS 1.0 and 1.1 are refused.
• Keyring vault entries are encrypted at rest.
• Databases accept connections only from the application servers, never from the internet.

Remote access you can account for

• Every remote-control session is tied to the person who opened it.
• API and MCP access is logged, with each token's actions recorded.

Your data

• Customer data stays on servers Optanik operates in the United States.
• OptaMeet transcripts and summaries are produced by OptAi on our own servers; they aren't sent to an outside AI provider.
• We don't sell customer data or use it for advertising. See the Privacy Policy for what we collect and the providers we use.

Backups and recovery

Production systems are backed up every day, with copies kept on a schedule of up to 3 years, so a lost server can be restored.

Compliance

Optanik follows a written set of security policies covering access control, change management, vulnerability management, logging, encryption, incident response, disaster recovery, vendors and data retention. We are preparing for an independent SOC 2 audit and haven't completed one yet; we'll publish the date here when we have a report. Card payments are handled entirely by Stripe, so card details never reach our systems. Organizations can request a data processing agreement at [email protected].

Report a vulnerability

If you think you've found a security issue in Optanik or our websites, email [email protected] with the details and steps to reproduce it. We'll acknowledge it within 3 business days and keep you updated while we fix it.

Please test only against your own account, don't access or change other customers' data, avoid anything that harms the service (such as denial of service or spam), and give us reasonable time to fix the issue before sharing it. We won't take legal action against good-faith research that follows these rules. Our contact details are also published in security.txt.

Incidents

If a security incident affects your data, we'll tell your organization's account owner promptly, and within 72 hours of confirming it, with what happened and what you should do.