Security

Your accounts stay in your name, and your site changes only when you say yes.

Who owns what, who can sign in, what waits for your approval and how a change gets undone. The technical detail is at the bottom.

Start free Technical detail
the short answer

How does askotter keep a small business's website and data safe?

A business using askotter keeps its domain, website content, customer contacts and ad accounts in its own name, and every account signs in with a passkey or a multi-factor code. Website changes publish only after the owner replies yes, and every change is logged and can be rolled back.

Encryption
TLS in transit, AES-256 at rest
Hosting
Microsoft Azure for the app and sign-in; AWS in a private network for stored data
Not for
Anyone who needs a named compliance certification on file before signing; request the security documentation first
what you own

Who owns the domain, the site and the data?

You do, from the first day, and it all leaves with you. The same terms apply to a website migration.

  • Your domain sits in an account in your name.
  • Your content is yours from day one. On a managed plan the site itself transfers to you after six months.
  • Your customer contacts are exportable at any time and never shared between accounts.
  • Your Google Ads account stays yours, and Google bills you directly.
who can sign in

Who can get into your account

Every person signs in with their own account using a passkey, an authenticator code or a hardware key; password-only login is off. You choose who to invite and what they see.

Team settings in the askotter portal. Example workspace, invented data.

approvals

What askotter can change, and what waits for your yes

  • Website and Business Profile. Nothing publishes until you approve it, the same step you use to run your website by text.
  • Ads. Changes inside rules you set run and are reported; anything that moves money waits. The rules are part of PPC management.
  • Customer emails. Every message is approved before it sends.
  • Undo. The previous version of every change is kept, and rolling back is a message.
technical detail

Hosting, encryption and how we patch

  • App, sign-in and API on Microsoft Azure behind a web application firewall; stored data on AWS in a private network with no public addresses.
  • TLS 1.3 preferred, never older than TLS 1.2. Stored data and backups encrypted with AES-256.
  • Sign-in on OpenID Connect and OAuth 2.0 with short-lived tokens.
  • Each customer's automations run separately on the server, and credentials never reach the browser.
  • Patches monthly, critical ones within 72 hours. Outside firms run penetration tests.
  • Report a suspected issue to security@askotter.ai.
questions

Questions about security and ownership

Who owns my website and domain if I use askotter?
You do. Your domain is in your name and your content is yours from day one. On a managed plan the site transfers to you after six months.

What happens if a change breaks something?
The previous version is kept, and rolling back is a message. Every change is logged with who asked and who approved it.

Can I give my staff access?
Yes. Each person gets their own sign-in, and you choose what they can see. A bookkeeper can be limited to billing.

How do I report a security issue?
Email security@askotter.ai. Security documentation and questionnaire answers are available on request.

Ask us anything about security.

Contact our team for detailed security documentation or to have a compliance questionnaire filled in.

Sign up for the free 14-day trial Get a free proposal

Self-managed is $99/mo and scales with the compute you use. Our team runs it from $600/mo.