Your customers trust you. Here is how we keep that trust.
Ora talks to your customers for you, so their data has to be safe. This page says, in plain words, where it is stored, who can see it and how to take it back.
Your account, chats and files live on our servers in Mumbai, India.
HTTPS everywhere. Keys, mailbox passwords and Team Vault logins are encrypted with AES-256 before they are saved. Passwords are hashed, never stored.
Ora asks your customers for consent in chat and on calls, as India's DPDP Act requires, and stops when they say no.
Ask for a copy of your data or for your account to be deleted at any time. Customers can type "delete my data".
Where your data lives
- Your account, your bots, chats, contacts and uploaded files are stored on our own servers in Mumbai, India.
- To write a reply, Ora sends only what that reply needs to our AI providers (through OpenRouter, xAI and OpenAI). Some of them process data outside India. We do not sell data, and we do not use your conversations to train public AI models.
- Payments go through Razorpay or PayPal. We never see or store card numbers.
How it is protected
- All traffic uses HTTPS.
- Channel keys, mailbox passwords, payment keys and Team Vault entries are encrypted with AES-256-GCM before they are saved. Every view or copy of a Vault entry is logged.
- Passwords are stored as one-way hashes (bcrypt), so nobody, including us, can read them.
- Each business's data is kept separate. Your team members only see what you allow, with roles and "own leads only" settings.
- New sign-ups confirm their email with a code, and repeated sign-up attempts are slowed down, which keeps fake accounts out.
Consent and your customers (DPDP Act)
- For your customers' data, your business decides how it is used and we process it on your instructions.
- Ora shows a consent notice in chat and reads a short notice at the start of AI phone calls.
- A customer can withdraw as easily as they agreed: tap "Withdraw consent", type "delete my data", or use the unsubscribe link in any email.
Who can see what
- Our support team only opens your account when helping you, and every time staff open your dashboard or change something in your account, it is recorded in an activity log.
- Ora Manager, the AI that reviews your assistant's chats, only suggests changes. Nothing changes without your approval, and every change can be undone.
Keeping, exporting and deleting
- We keep your data while your account is active. You can ask for a copy at any time.
- When you ask us to delete your account, we remove your bots, chats, contacts, files and team logins. Payment records and GST invoices are kept only as long as tax law requires.
- If a breach ever affects personal data, we will tell affected users and the authorities as the law requires.
Questions
Is Ora SOC 2 or ISO 27001 certified?
Not yet. We are a young company and those audits are on our roadmap. Until then, this page lists exactly what we do today, and we are happy to answer any security questionnaire.
Does the AI learn from my customers' chats to help other businesses?
No. Your content and conversations are used only for your own account. Each business's assistant answers only from what that business taught it.
Can I get my data out?
Yes. Email us and we will send you a copy. On plans with the API & export module you can also export it yourself.
How do I report a security problem?
Email propheciustech@gmail.com with the subject "Security". We reply quickly and will credit you if you want.
propheciustech@gmail.com · Prophecius Media Pvt Ltd, India. Full details in our Privacy Policy.