Security at HeyOtto

Encryption In Transit and At Rest

All conversations with Otto are encrypted using industry-standard AES-256 encryption. Messages are encrypted in transit and at rest.

• TLS 1.2 or higher for all data transmission, with TLS 1.3 used where the client supports it
• AES-256 encryption for stored data
• Periodic security reviews, including penetration testing conducted approximately annually

We intentionally do not use end-to-end encryption. Real-time safety monitoring, content filtering, and parent visibility all require our systems to process every conversation — that's what makes the safety features possible. We protect that access with strict encryption, access controls, and the data-minimization practices below, rather than a design that would prevent us from being able to see anything at all.

Real-Time Content Monitoring

Our AI-powered content filtering system analyzes every message Otto sends and receives in real-time to detect and prevent inappropriate content, ensuring age-appropriate conversations at all times.

• Advanced profanity and inappropriate content filtering
• Personal information detection and blocking
• Instant alerts for concerning patterns

Secure Infrastructure

HeyOtto is hosted on enterprise-grade infrastructure with multiple layers of security and redundancy, and controls aligned with industry compliance frameworks — including SOC 2 Type II, which we are actively pursuing certification for.

• Hosted on Vercel's secure infrastructure
• Automatic backups and disaster recovery
• Built for high availability, with infrastructure designed to minimize downtime

Data Privacy & Compliance

Your child's data is never sold, shared with advertisers, or used for any purpose beyond providing the HeyOtto service.

• Minimal data collection — only what's necessary
• No third-party advertising or tracking
• Parent-controlled data access and deletion

Built with COPPA compliance as a foundation — see our COPPA Notice and Trust Center for details.

Vulnerability Disclosure

We work with independent security researchers to keep HeyOtto safe. If you've found a vulnerability, we want to hear from you — and we've published clear rules of engagement, including a strict requirement that research never involve real children's accounts or data.

Incident Response

Our team monitors for threats and has established protocols to respond quickly to any security incidents, with transparent communication to affected families if an incident occurs.