1.
Read-only by default
Connectors ask for the narrowest read access each tool offers. Oko only writes anything back, like posting requirements to a ticket, if you turn that on.
Trust Center
How we look after your designs.
You’re trusting us with plans for things you haven’t built yet, and probably haven’t announced. Here’s how we handle them.
Principles
How we handle your data.
2.
No training on your data
Your documents, tickets and code are never used to train shared or third-party models.
3.
Encryption
Everything sent to or from Oko goes over TLS, and the data we store is encrypted at rest.
4.
Tenant isolation
Each customer’s data is logically isolated, and every request is checked to make sure it belongs to that customer.
5.
Access controls
SAML SSO, SCIM provisioning and role-based permissions, with every action recorded in an audit log.
6.
You decide what we keep
Choose how long Oko keeps source content, and we’ll delete your data whenever you ask.
FAQ
Questions security teams ask us.
What data does Oko access?
Only the spaces, projects and repositories you connect. You choose the scope during setup and can change it at any time.
Does Oko need access to our source code?
No. Code access is optional and only used for design-to-code drift checks. Design review works from documents and tickets alone.
Which sub-processors does Oko use?
A short list of established infrastructure providers, all under agreements that prohibit training on customer data. Email us and we’ll send the current list.
How do I report a vulnerability?
Email security@okosecurity.com. We reply to every report, and we won’t take action against anyone doing good-faith research.