Ora Security Policy

From confidential business project to personal home todo lists, our users trust us to keep their data secure, private, and available whenever they need it. We take that responsibility seriously.

At Ora, we maintain a security system that:

• Prevents all unauthorized access
• Supports continuous monitoring for potential vulnerabilities
• Embraces ongoing, proactive improvement to stay on top of the latest security tools and threats.

Data Protection

In Transit

All user data including project names, task names, comments, uploaded files, account information, and payment information are sent using SSL/HTTPS secure channels with 128bit, bankstandard encryption.

At Rest

We use Amazon Web Services (AWS) servers to host all user data and files. We make extensive use of their built-in firewalls to protect your data against unauthorized remote access.

Projects, tasks, comments, account information, and payment information are all stored and encrypted at rest.

All files are stored and encrypted at rest. Encrypting these files adds an additional layer of security.

AWS data centers undergo annual certifications to ensure they meet the highest standards of physical and virtual security. You can find more information on AWS security practices at http://aws.amazon.com/security/.

All data included in Dropbox and Google Drive attachments remain on those companies’ servers and are covered by their respective security policies and practices.

Data Reliability

All user data is automatically backed up on AWS servers with the capability to provide point-in-time recovery down to the second.

Additionally, Ora creates automatic backups within the app on a daily basis. You can also create a backup at any time. These backups can be accessed in Account Settings and can be used to recover data for any project or task. You can find more information about how backups work here.

Account Access

We verify account access through both email/password-based authentication and Google Accounts authentication via Oauth 2.0.

When email/password-based authentication is used, we always store individuals passwords with unique salts to add an extra layer of protection to your account.

Alternatively, Oauth provides a seamless way to create and access your account without Ora ever needing to access or store your Google login credentials.

Ora Admin Controls

For all Ora accounts, we provide two different user roles and access privileges: admin and member.

Account administrators have access to the central control panel to manage billing information, users, and sharing settings. Access to any shared projects must be granted by the account administrator from the control panel.

Sharing Settings allows the administrator to choose between restricting sharing to only employees within the organization or allowing sharing outside of the organization (e.g., with clients, vendors, etc.).

Data Privacy

We make it a priority to be transparent in how we collect, use, and handle your information when you use our website and software. Please see our privacy policy for more details.