Skip to main content
OTO holds order records, customer addresses, phone numbers and payment methods for merchants across three markets. Everything on this page exists because that data is not ours — it is yours, and your customers’.

​
Where OTO stands

Why both ISO 27001 and SOC 2, and why the difference mattersThey are not duplicates, and a reviewer who knows the difference will check for both. ISO 27001 certifies the system: that OTO has a defined way of identifying risk, selecting controls and improving them, and that an accredited body has examined it. SOC 2 Type II reports on the evidence: that specific controls did not merely exist on paper but operated effectively across months of real activity.A Type I would say the controls were designed correctly on the day someone looked. Type II says they held up. That distinction is the reason enterprise procurement asks for Type II by name, and it is the one OTO holds.

​
Where your data lives

Data residency is a deployment decision, not a fixed property of the platform. In-Kingdom hosting is available for merchants whose regulatory position, customer base or procurement policy requires Saudi data to stay in Saudi Arabia; other deployments run outside the Kingdom where that is the better fit.
Settle residency before the contract, not afterResidency is straightforward to arrange at the start of a deployment and expensive to change once historic data exists and integrations are pointed at an environment.If in-Kingdom hosting is a requirement rather than a preference — and for government-adjacent buyers and regulated sectors it usually is — raise it during evaluation so the environment is provisioned correctly the first time.

​
Who can get in

​
How credentials work

The API uses a two-token model deliberately. A permanent refresh_token, issued from the dashboard, can do exactly one thing: obtain a short-lived access_token. That access token expires after one hour, and every other call carries it as a bearer token.
Short-lived tokens limit the blast radiusThe point of the split is what happens when something leaks. A captured access token is useful to an attacker for at most an hour, and then it is worthless.Which is why the permanent token deserves the care you would give a password — secrets manager or environment variable, never a repository, a mobile bundle, a support ticket or a screenshot. It is the one credential that does not expire on its own.

​
How data is protected

​
How it is tested

A bug bounty is a statement about posture, not just a budget lineRunning one means accepting that outsiders will find things, and building the process to triage and fix them quickly. Organizations that are not confident in their own code do not invite strangers to look at it.

​
Fraud controls

In a market where cash on delivery is normal, fraud is an operational cost rather than an edge case. OTO carries detection for the patterns that matter here — including customers cycling through multiple addresses, and abuse of account deletion to escape a history. Related merchant-side controls live in pre-fulfillment checks: blacklisting, COD order confirmation and payment-method verification before an order is allowed to consume stock.

​
What is yours to do

Security of the platform is OTO’s responsibility. Security of how you use it is shared, and these are the four that matter most.

​
Requesting documentation

The ISO 27001 certificate, the SOC 2 Type II report and penetration test summaries are available to customers and to prospects under evaluation. The report is shared under NDA, as is standard. Ask your account contact, or write to support@tryoto.com, and include the regime or questionnaire you are working against so the right documents come back the first time.