Security

Effective: October 1, 2026

This page describes how Ortivs protects the website, the concierge and the systems behind them, and how to tell us about a security problem. It stays general on purpose: we don't publish details that would help an attacker.

How we work

Hosted on Microsoft Azure. The website is a set of static files on Azure Static Web Apps, with no server code or database of its own. The concierge runs in your browser and sends nothing by itself: your request reaches Ortivs only as an email you send to hello@ortivs.ai.

A person approves changes. Changes to our systems are written down, reviewed and approved by a person before they run. That includes changes our own software agents prepare. The record shows what changed, who approved it and when.

Least privilege. People, services and software agents get only the access their job needs.

Secrets stay out of code. Passwords, keys and tokens are kept in Azure Key Vault or in protected storage on Ortivs computers that only Ortivs can read. They never go into source code or email.

A narrow front door. The site has no forms that write to Ortivs systems. Requests arrive as email to Microsoft 365 mailboxes that only Ortivs staff can read.

Pages load from one place. The site loads its scripts, fonts and images from ortivs.ai only, and it tells browsers, through a content security policy, to block anything else.

Incidents follow the same process. When something goes wrong, we open an incident record, fix it through the same record-and-approve process, and keep the record afterwards. If an incident affects your personal information, we'll tell you as the law requires.

Reporting a vulnerability

If you think you've found a security problem in ortivs.ai or the concierge, email security@ortivs.ai. Tell us what you found, how to reproduce it and how to reach you.

While you look into it, please:

• give us a reasonable time to fix the problem before you tell anyone else;
• don't access, change or delete data that isn't yours;
• test the concierge only with your own requests, and don't flood our mailboxes;
• don't try to degrade the service, and don't use social engineering or physical attacks.

We'll acknowledge your report within 3 business days and keep you posted while we work on it. A person at Ortivs reviews every reply. If you follow these rules and act in good faith, we won't take legal action against you for your research.

We don't run a paid bug bounty.

What this page isn't

This page describes how we work today. It isn't a service level agreement or a contract.