Current Launch Scope
The self-service MVP is currently intended for U.S.-based business customers using the service within its documented product scope.
A requester may provide a location so that the customer can route and review the request. Otterportal does not use that location to select an applicable law, calculate a legally required deadline, determine requester rights, or produce a legal outcome.
An organization considering use outside the documented scope is responsible for completing its own product, legal, privacy, security, and operational review before doing so.
Application Controls
The current application is designed to support:
- signed, expiring, single-use email-confirmation links;
- scoped requester sessions;
- server-side role and access checks;
- same-origin protections for supported state-changing requests;
- rate limiting for supported routes and workflows;
- optional authenticator-app multifactor authentication for supported administrator accounts;
- server-side tenant scoping for supported workspace data operations;
- requester-facing responses that exclude designated internal workflow information;
- audit and verification records that are restricted from ordinary user editing, subject to authorized system operations and configured retention deletion; and
- application-layer encryption for queued email content and authenticator secrets when valid production encryption keys are configured.
These descriptions refer to the product's current design and implementation. They do not guarantee that every vulnerability, configuration error, misuse, or security incident will be prevented.
Deployment-Dependent Controls
The repository and application code do not independently establish that external infrastructure controls are active or correctly configured.
Depending on the production environment, the following controls may require separate implementation, configuration, testing, and ongoing operation:
- TLS and certificate management;
- database, storage, and backup encryption;
- private networking;
- secrets and encryption-key management;
- backup schedules;
- backup restoration testing;
- monitoring and alerting;
- provider security configuration;
- incident-response procedures;
- access reviews;
- infrastructure patching; and
- designated operational and security personnel.
The production operator is responsible for verifying that required deployment controls are active and operating as intended.
Current Product Boundaries
Otterportal does not currently:
- host identity documents;
- host or deliver requester response files or response packages;
- provision functional team invitations;
- export workspace-wide audit events;
- store or process payment-card details in Otterportal;
- issue customer API keys;
- deliver webhooks; or
- determine legal obligations, verification sufficiency, request outcomes, or applicable deadlines.
Organizations must use reviewed external processes for activities outside the supported product scope.
Assurance and Testing
The controls described on this page are not a penetration-test report, security audit, legal opinion, certification, or independent assurance statement.
Customers remain responsible for conducting due diligence appropriate to their intended use, data sensitivity, legal obligations, risk profile, and deployment environment.
The presence of a particular feature or security control does not mean that Otterportal or a customer satisfies any specific law, contractual requirement, certification framework, or security standard.
No Certification or Compliance Claim
Otterportal does not currently claim:
- GDPR compliance;
- CCPA or CPRA compliance;
- compliance with any other state privacy law;
- SOC 2 attestation;
- ISO/IEC 27001 certification;
- regulator approval;
- independent security certification; or
- guaranteed security or uninterrupted operation.
Any future audit, certification, assessment, or compliance statement should identify its exact scope, date, issuing or assessing body, applicable service or environment, and supporting report or documentation.