Security at HeyOtto

Protected at every layer

Encryption In Transit and At Rest

All conversations with Otto are encrypted using industry-standard AES-256 encryption. Messages are encrypted in transit and at rest.

• All conversations are encrypted in transit using TLS 1.2 or higher.
• AES-256 encryption for stored data
• Periodic security reviews, including penetration testing conducted approximately annually

We intentionally do not use end-to-end encryption. Real-time safety monitoring, content filtering, and parent visibility all require our systems to process every conversation — that's what makes the safety features possible. We protect that access with strict encryption, access controls, and the data-minimization practices below, rather than a design that would prevent us from being able to see anything at all.

Age-appropriate by default

Real-Time Content Monitoring

Our AI-powered content filtering system analyzes every message Otto sends and receives in real-time to detect and prevent inappropriate content, ensuring age-appropriate conversations at all times.

• Advanced profanity and inappropriate content filtering
• Personal information detection and blocking
• Instant alerts for concerning patterns

Enterprise-grade hosting

Secure Infrastructure

HeyOtto is hosted on enterprise-grade infrastructure with multiple layers of security and redundancy.

• Hosted on Vercel's secure infrastructure
• Automatic backups and disaster recovery
• Built for high availability, with infrastructure designed to minimize downtime

COPPA by design

Data Privacy & Compliance

Your child's data is never sold, shared with advertisers, or used for any purpose beyond providing the HeyOtto service.

• Minimal data collection — only what's necessary
• No third-party advertising or tracking
• Parent-controlled data access and deletion

Built with COPPA compliance as a foundation — see our COPPA Notice and Trust Center for details.

Safe harbor for researchers

Vulnerability Disclosure

We work with independent security researchers to keep HeyOtto safe. If you've found a vulnerability, we want to hear from you — and we've published clear rules of engagement, including a strict requirement that research never involve real children's accounts or data.

Ready when it matters

Incident Response

Our team monitors for threats and has established protocols to respond quickly to any security incidents, with transparent communication to affected families if an incident occurs.