Security at OKRs Tool.

Section 1
Our security approach

OKRs Tool is built for teams who care about how their data is handled. Whether you're a 50-person company evaluating us against an enterprise platform or a 200-person organization finalizing procurement, this page documents what we do to protect your data.

Our security posture sits across four layers: infrastructure (where data is hosted), application (how the platform protects data day-to-day), access (who can see what), and response (what happens if something goes wrong).

Section 2
Infrastructure & encryption

OKRs Tool runs on infrastructure operated by providers with independent SOC 2 Type II audits — our database and authentication run on Supabase, application hosting and edge security on Cloudflare, all underpinned by Amazon Web Services (AWS). This means our underlying hosting environment has been evaluated against industry-standard security, availability, and confidentiality criteria by independent auditors.

Specifically:

• Encryption in transit. All connections use TLS 1.2 or higher. We do not accept legacy SSL or unencrypted HTTP for any data exchange.
• Encryption at rest. Data stored in our databases and backups is encrypted using industry-standard AES-256 encryption.
• DDoS protection & WAF. Cloudflare provides DDoS mitigation and a web application firewall on all incoming traffic.
• Continuous security scanning. We run regular automated application and dependency vulnerability scanning, with findings triaged and remediated by severity. Our infrastructure providers maintain their own independent security testing under SOC 2 Type II and ISO 27001 audits.
• Continuous monitoring. Infrastructure monitoring runs 24/7 with automated alerting for anomalies.

Note on certification: OKRs Tool's underlying infrastructure providers (Supabase, Cloudflare, AWS) are independently SOC 2 Type II audited. OKRs Tool itself has not yet completed an independent SOC 2 audit at the application layer. We can share infrastructure audit reports under NDA on request — contact info@okrstool.com.

Section 3
Access controls

Security at the application layer is about who can see what. Our practices:

• Role-based access control (RBAC). Workspaces support predefined roles — Owner, Admin, Member, Viewer — with different permissions per role. Tenant isolation between organizations is enforced at the database layer through row-level security (RLS).
• Single Sign-On (SSO). Available on the Enterprise plan via SAML and Google Workspace SSO.
• Two-factor authentication (2FA). Available for all users on every plan.
• Session timeout. Admins can enforce automatic sign-out after a set idle period and/or a maximum session length, workspace-wide, including SSO users. Idle and absolute limits are configurable independently, or disabled to keep sessions open until manual sign-out.
• Privacy rules. Fine-grained controls govern who can view or modify OKRs at the workspace level. Sensitive workspaces can be restricted to specific roles.
• Audit logs. Sensitive actions are logged with user, action, and timestamp. Logs are available to workspace admins on the Enterprise plan.
• Internal access. Access to customer data by OKRs Tool staff is restricted to a small number of authorized engineers, requires explicit business justification, and is logged.

Section 4
Data hosting & availability

• Database & authentication: Supabase, hosted in the EU (Ireland) on AWS infrastructure
• Application hosting & edge: Cloudflare (CDN, WAF, DDoS mitigation)
• Data residency: Customer OKR content is stored in the EU (Ireland). A small number of sub-processors (e.g. billing, AI, analytics) process limited data outside the EU under Standard Contractual Clauses — see our sub-processor list
• Backups: Daily automated backups with secure point-in-time recovery
• Uptime monitoring: 99.9% uptime SLA on Enterprise plan
• Observability: Performance and error monitoring via Datadog

Section 5
Incident response

If a security incident affecting customer data occurs:

1. We detect and contain the incident through 24/7 monitoring and automated alerting.
2. We assess the scope and impact within hours of detection.
3. We notify affected customers within 72 hours where legally required (e.g., GDPR Article 33), or sooner where practicable.
4. We provide a post-incident report describing what happened, what data was affected (if any), and what we're changing to prevent recurrence.

Customers can request a copy of incident response procedures under NDA by contacting info@okrstool.com.

Section 6
Vulnerability disclosure

We welcome reports of suspected security vulnerabilities from customers, security researchers, and the wider public, and we treat every report seriously.

• How to report. Email security@okrstool.com with details of the suspected vulnerability, including steps to reproduce where possible.
• Acknowledgement. We aim to acknowledge reports within 2 business days and to provide an assessment and remediation plan for valid issues based on severity.
• Good-faith safe harbour. We will not pursue action against researchers who report in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.
• Please avoid. Accessing or modifying other users' data, degrading the service, or running automated scanning that affects availability.

Section 7
Compliance commitments

• GDPR. Fully aligned with GDPR principles, including consent, access, and deletion rights. See our Privacy Policy for details.
• Data Processing Agreement (DPA). Available to customers upon request — email dpo@okrstool.com.
• AI sub-processors. AI-powered features are delivered using a vetted AI provider. Customer data sent to power these features is not used to train models and is not shared across accounts. See our sub-processor list for details.
• Google API compliance. Use of Google APIs (Calendar, Sheets) adheres to the Google API Services User Data Policy, including Limited Use requirements. See our Google User Data section in the Privacy Policy.
• Sub-processor transparency. A current list is available at okrstool.com/sub-processors.

Section 8
Responsible AI & data retention

Responsible AI

OKRs Tool includes AI features — such as OKR insights, drafting and coaching suggestions — delivered through a vetted AI provider. Our approach is