How we protect your data.
OTW Signal is built by a company that sells measurement honesty, and we apply the same standard to security: this page states what we actually do, including what we have not done yet. Last updated July 2026.
Application security
- All traffic is TLS-encrypted end to end; HSTS is enforced on every page and API response.
- Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, per-password salt). Sign-in supports Google and Microsoft OAuth and magic links.
- Sessions are server-side, expiring, HttpOnly, Secure, SameSite cookies. Login, signup, magic links, and password resets are rate limited; bot checks (Cloudflare Turnstile) protect auth endpoints.
- Every database query is parameterized; report rendering escapes all externally influenced content; strict CORS and security headers throughout.
- Sensitive operations (account deletion, data deletion, payouts) are recorded in an append-only audit log.
Payments
All payment collection is hosted by Stripe (PCI DSS Level 1). Card numbers never touch our servers, which places us in PCI SAQ A scope, the narrowest possible. We store only transaction records: amount, date, status.
Infrastructure & availability
- Runs entirely on Cloudflare's global edge (Workers + D1), behind Cloudflare's always-on DDoS mitigation.
- Automatic point-in-time database recovery covering the last 30 days, verified restore points, plus periodic cold backups of critical tables.
- Independent external uptime monitoring probes the site, the API, and the database every 5 minutes.
- Documented incident response and disaster recovery runbook, including data-breach notification duties (PIPEDA, Quebec Law 25, GDPR).
Privacy
Self-serve data export and deletion for every customer, a published privacy policy with a full data inventory and retention table (also en français), GDPR lawful bases, and a named privacy officer. Analytics run only after cookie consent.
Subprocessors
We use these providers to run the service. We will update this list before adding a subprocessor that handles personal data; enterprise customers can request change notifications as part of a DPA.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare | Hosting, database, edge network | All service data | Global (primarily North America) |
| Stripe | Payment processing | Payment and billing details | US/global |
| Resend | Transactional email | Email address, report links | US |
| Analytics (post-consent), OAuth sign-in, Gemini measurement API | Aggregate usage; OAuth email; measurement prompts | US/global | |
| OpenAI | ChatGPT measurement API | Measurement prompts (business name, questions) | US |
| Anthropic | Claude measurement API | Measurement prompts | US |
| Perplexity | Perplexity measurement API | Measurement prompts | US |
Measurement prompts contain your business name, website, and buyer-intent questions: information already public by nature. Customer account data is never sent to the AI engines.
Vulnerability disclosure policy
We welcome good-faith security research. If you believe you have found a vulnerability:
- Email security@otwmotion.com (or melinda@otwmotion.com) with steps to reproduce. Our security.txt mirrors this.
- We will acknowledge within 3 business days, keep you informed, and credit you if you wish. We do not currently pay bounties.
- Safe harbor: we will not pursue legal action for good-faith research that respects user privacy, avoids service disruption and data destruction, does not access other customers' data beyond what is needed to demonstrate the issue, and gives us reasonable time to fix before public disclosure.
- Out of scope: denial of service, social engineering, spam, physical attacks, and findings on third-party services (report those to the third party).
Compliance status, stated honestly
| Item | Status |
|---|---|
| PCI DSS | SAQ A scope via Stripe-hosted checkout |
| GDPR & UK GDPR | Lawful bases documented; self-serve export and deletion; consent-gated analytics |
| PIPEDA & Quebec Law 25 | Privacy officer named; French-first Quebec disclosures; breach process documented |
| Internal security audit | Completed July 2026 (authentication, injection, XSS, CSRF, access control) |
| SOC 2 | Not yet certified. On our roadmap as enterprise demand matures; our controls are documented and we answer security questionnaires promptly. |
| External penetration test | Not yet performed; scheduled ahead of first enterprise deployment. Internal audit completed. |
Data Processing Agreement
Enterprise customers can review our standard Data Processing Agreement. To execute it, email melinda@otwmotion.com.
Questions about anything on this page: melinda@otwmotion.com. We would rather answer a hard question than let it go unasked.