Security

Ollie can book, pay and send things for you. That needs more trust than a chatbot, so this page says plainly how it works. It only describes what's in place today.

Nothing happens without your yes

  • Before Ollie books, buys, sends, posts or changes anything, it tells you exactly what will happen, and the price, and waits for a clear yes.
  • Never send card numbers, passwords or one-time codes in the chat. They go in your vault, and codes and CAPTCHAs you type yourself through a private live link.

Your vault

  • Encrypted item by item (AES-256-GCM) before it's saved, bound to you, so one person's item can't be read as another's.
  • The AI never sees card numbers, security codes or passwords. Our servers type them straight into the website, only during a job you approved, and we stop keeping screenshots of that job once one has been typed.
  • Private links. The vault opens only from a link Ollie sends you, which works for 30 minutes, and a visit lasts an hour.

Your apps

  • Access tokens and keys for the apps you connect are encrypted like your vault and only readable by our servers.
  • Ollie asks before anything that sends, posts, creates or changes something in an app.
  • Disconnecting deletes the key, and where the app allows it, also revokes our access there.

Other people's Ollies

  • Ollie only passes on what you asked it to send, never anything from your vault, calendar or chats.
  • Business introductions share your name only after both people say yes. A no is final, and blocking someone hides you from each other.

Your data stays yours

  • The tables that hold your data can only be read by our servers, never by a browser or app.
  • Every table has automated tests that try to read or change another person's data, and must fail.
  • Encrypted in transit and at rest. The database is in the United Kingdom (London). Every provider we use is listed in the privacy policy.
  • Reply "delete my data" to Ollie and everything goes.

What we don't have yet

Hollo is new. We don't hold certifications like SOC 2 or ISO 27001 yet, and we won't claim them before we do.

Report a problem

If you think you've found a security issue, email contact@hollo.so. Please give us a chance to fix it before telling anyone else. We'll reply quickly and keep you updated.