Security at OttoDash
OttoDash handles bank activity, invoices and platform payouts, so it is built around one idea: it reads, and people decide. This page describes how it works today. Questions: [email protected].
Read-only by design
- OttoDash connects to NetSuite through OAuth 2.0 machine-to-machine (certificate) authentication with a role you create that has view permissions only.
- Independently of that role, the connector refuses any query that is not a single
SELECT. - OttoDash never posts transactions, sends email or moves money. What needs to go into NetSuite is produced as an import file that a person reviews and imports. Follow-up emails and order replies are drafts.
- Platform connections (Shopify, Amazon, Stripe, PayPal, Google, Microsoft) request read scopes only.
Secrets
- Connection keys and tokens are encrypted on the server with AES-256-GCM. The encryption key is held outside the database.
- No screen or API response ever returns a saved secret. The NetSuite private key is generated by OttoDash and never leaves the server; you upload only the public certificate to NetSuite.
Sign-in and access
- Sign-in with Microsoft or Google (OpenID Connect with PKCE). OttoDash stores no passwords.
- Only people an admin adds can open a company. Roles are preparer, reviewer and admin; a change or removal applies on the next request.
- Reviewers approve prepared work, and nobody can approve their own.
- Sessions are stored as one-way hashes, and sign-in links expire after ten minutes.
Keeping companies apart
- Each company's data is tagged with its company and filtered by row-level security in the database, so one company's session cannot read another's rows even through a software fault.
- The company a person works in comes from their signed-in session, never from anything the browser sends.
- Our automated tests include signing in as one company and trying to read, write or switch into another.
Logging and monitoring
- Every request is written to an access log (who, what, when, result) that the application can add to but not change or delete.
- Requests are rate-limited per session, and the server sends strict browser security headers (content security policy, no framing, no content sniffing).
AI
Matching, classification, totals and dates are done by rules that are tested and readable. Anthropic's Claude is used only to read PDF statements and emails the rules cannot parse, and to explain a result when someone asks. It can be switched off entirely, and each company's monthly usage can be capped.
Your data, your call
- An admin can download all of the company's saved work and settings at any time from Settings (connection secrets are left out).
- An admin can delete the company from Settings; its data is removed from the application database and everyone is signed out.
- See the privacy policy for what we collect and how long we keep it.
Reporting a vulnerability
If you think you've found a security problem, email [email protected] with "Security report" in the subject. Please give us a reasonable time to fix it before making it public. We don't take legal action against good-faith research.