Security

Optonum (operated by Optonum LLC) is designed for manufacturing data that may include production volumes, costs, supplier information, and workforce records. Security is implemented in layers: identity, authorization, encryption, tenant isolation, auditability, and human-in-the-loop controls for autonomous AI.

We are pre-SOC 2. Enterprise customers may request a security questionnaire and our subprocessors list.

Access controls include:

• Supabase Auth for sign-up, login, session management, and OAuth providers (Google) as configured.
• Organization- and project-scoped roles with server-side authorization on API routes and dashboard layouts.
• Protected routes enforced in middleware; unauthenticated users are redirected to login.
• Secrets (database URLs, LLM API keys, Stripe keys) stored in server environment variables — never exposed to client bundles.
• Autonomous AI agents cannot mutate production data without an explicit human approval step (Change Request workflow).

Technical measures:

• HTTPS/TLS for all browser, API, and webhook traffic.
• PostgreSQL hosted on Supabase with provider-level encryption at rest.
• Multi-tenant data isolation at the application layer — queries scoped by organization and project membership.
• Simulation runs in your browser or as a server-side job from the app; results and saved runs stay scoped to your organization and project.
• Immutable audit log entries for compliance-sensitive mutations (checklist / CAPA-style workflows on Enterprise — not a validated Part 11 MES claim).

LLM providers (Google Gemini, optional OpenAI) receive only the context required for a specific assistant message or agent run — summarized factory metrics, not full database exports.

Agent outputs are stored as Change Requests with audit metadata (AgentRun records, timestamps, input snapshots) before any apply action.

Free-tier AI assistant usage is rate-limited per organization to prevent abuse and control inference cost.

Command Center agents run only on demand (Run AI), within plan-based caps; there is no scheduled agent scan today. Every proposal waits for human approval.

Configure zero-data-retention or enterprise API terms with your LLM provider for production deployments handling sensitive IP.

We rely on audited infrastructure and SaaS providers. Current subprocessors:

Practices we follow:

• Type checking and the automated test suite run in CI on every push and pull request.
• Production deployments on Vercel with environment-scoped secrets.
• Database migrations via Prisma; production schema changes are reviewed before apply.
• Cron endpoints protected by CRON_SECRET bearer token.

Report security vulnerabilities or suspected incidents to hello@optonum.com with subject line "Security Report". We acknowledge validated reports within 3 business days and investigate promptly.

For incidents affecting customer personal data, we will notify affected customers and regulators as required by applicable law (including KVKK and GDPR where relevant).

We do not support unsolicited penetration testing against production without prior written authorization.

Operator: Optonum LLC, 1021 E Lincolnway, Ste. 10591, Cheyenne, WY 82001, United States.