# Data Security Commitment — OTFeed.com

**Last Updated:** August 19, 2026

We know what we're asking for: your OT device inventory. That's sensitive infrastructure data. Here's exactly how we protect it.

## Encryption at Rest

All customer data is encrypted with **AES-256 (SQLCipher)**. Your database cannot be read without the encryption key. This applies to both your account data and your device selections.

## Physical Separation

Your account information and your device selections are stored on **two physically separate servers**:

- **Server 1** holds your email, API key, and an opaque device code
- **Server 2** holds the mapping from device code to vendor/product/protocol

Neither server alone reveals which devices you monitor. A breach of one system does not expose your complete profile.

## Minimal Data Collection

We only require your **email address**. We do not store your name, company, phone number, or physical address. Less data collected = less data at risk.

## Access Controls

All API access requires authentication keys transmitted in HTTP headers only — never in URLs where they could be logged by proxies or CDNs. Every device resolution query is logged and rate-limited to prevent bulk enumeration.

## Secure Transit

All web and API traffic is encrypted with **HTTPS/TLS**. Our servers enforce security headers including Content-Security-Policy, HSTS, and X-Content-Type-Options.

## Audit Logging

Every query that resolves your device codes is logged with a timestamp. We can detect and respond to unusual access patterns.

## No Public Customer List

Your use of OTFeed is not visible to other customers, vendors, or the public. We do not publish customer names, case studies, or logos without explicit permission.

## Data Ownership

You can **export** all your data at any time in JSON/CSV format. You can **delete** your account and all associated data at any time. Deleted data is removed within 30 days.

## Breach Notification

In the event of a confirmed data breach affecting your information, we will notify all affected users within **24 hours** of confirmation. We will disclose what was accessed, when, and what steps we are taking.

## Transparency

If you have questions about how we handle your data, email us at [privacy@otfeed.com](mailto:privacy@otfeed.com). We'll give you a straight answer.

---

For full details, see our [Privacy Policy](privacy.html) and [Terms of Service](terms.html).