A prospective customer can review three things about Otukan: how our products keep your keys, releases and data under your control, how we handle the information you send us, and how to report a vulnerability to us. Each is a practice you can verify. We separate policies, technical practices and independent attestations so your reviewer sees exactly what each item is, and we list an attestation here only when a report exists that you can ask to see.
Published evidence
Buyers often treat three kinds of evidence as one. We keep them apart.
| Kind of evidence | What it means | What Otukan offers |
|---|---|---|
| Policies | Written commitments you can read | The privacy policy, website terms and cookie preferences pages |
| Technical practices | How keys, releases and data are actually handled | Described below for our products, enquiries and the App Exposure Check |
| Attestations | Independent certification, audit or penetration test reports | Listed on this page, with how to request each, once a report exists |
Security built into how the products work
Your release stays yours. Otukan Application Security fits your existing build and release pipeline. You sign and publish every protected build with your own keys, which never leave your control.
Your management data stays where you decide. Otukan Device Management lets you choose where management data lives, so an institution with residency or sovereignty requirements keeps its fleet data under its own authority.
Your firmware authority stays with the device maker. Otukan Device Security is built together with the party that holds firmware and signing authority for each device model.
For the detail, see mobile app security data privacy, sovereign mobile device security and MDM data sovereignty.
Enquiry data
Our contact forms ask for your name, work email and company, and optionally your role, plus the context of your enquiry: the product, the platforms, your main requirement and the page you came from. You can remove the page and platform context before sending. We use these details only to reply. We do not add you to a mailing list and do not share your enquiry with third parties for their own use. Your rights are set out in the privacy policy.
App Exposure Check data
The App Exposure Check is a passive review of the public store release of your Android or iOS app. Steps 1 to 3 of the request hold only the store link and context about your app. They contain no personal data and stay in your own browser until you send the request or clear the form. Contact details are asked for only in step 4, and findings go by email only to a contact we have verified as representing the publisher.
What we never ask for
We never ask for binaries or file uploads, source code, signing keys, API keys or other secrets, credentials or test accounts, production data, or access to your infrastructure. If a request for any of these reaches you in Otukan’s name, treat it as suspicious and tell us at info@otukan.co.
Requesting diligence material
Security questionnaires and vendor reviews are welcome. Send your questionnaire through the contact page and say which product it concerns. We answer every item plainly, tell you which answers we can share straight away and which need a confidentiality agreement first. Please keep your own confidential material out of the first message.
Every answer describes a practice that exists. We never describe a control or certification to complete a form.
Reporting a vulnerability
If you believe you have found a security vulnerability in Otukan’s website, forms or published material, email info@otukan.co with a description, steps to reproduce and the affected address. Please do not access data that is not yours, do not degrade the service, and give us the chance to investigate before publishing details.
Keeping this page current
This page is reviewed whenever a form, processor or data practice on the site changes. Every policy listed names Otukan as its owner. If anything here no longer matches what our products or this site do, tell us at info@otukan.co.