Security · How we protect data

    Security at Origin Lab.

    We collect and process gameplay and robotics training data for AI labs. Keeping that data, and our partners’ information, secure is a core part of the product.

    SOC 2 Type 2 audit in progress (Sensiba), report expected Q1 2027.

    01/Practices
    What we do today.

    H
    Hosting and encryption

    Production runs on Amazon Web Services. Databases, volumes and object storage are encrypted at rest, and all traffic to our services is encrypted in transit with TLS.

    A
    Access control

    Staff sign in through Google Workspace single sign-on. Access follows least privilege with role-based permissions in the platform, and multi-factor authentication is enforced on cloud root accounts and being rolled out to every account.

    M
    Monitoring

    AWS CloudTrail records account activity across regions with log-file validation. Amazon GuardDuty and AWS Security Hub continuously check for threats and misconfigurations, and alerts reach the team in real time.

    S
    Secure development

    Every change ships through a reviewed pull request. Continuous integration runs tests and security scans, Dependabot and secret scanning cover our repositories, and production deployments require an explicit approval.

    V
    Vendor management

    We keep a register of the subprocessors that handle our data and review their security posture as part of our compliance program.

    I
    Incident response

    Report a suspected security incident to security@originlab.ai. We acknowledge reports within 3 business days and keep you informed until the issue is resolved.

    02/Responsible disclosure
    Report a vulnerability.

    If you believe you have found a security issue in originlab.ai, app.originlab.ai, the Recorder or our SDK, we want to hear from you.

    • Email security@originlab.ai with the affected URL or component, steps to reproduce and the impact you observed. PGP is not available at this time.
    • We acknowledge reports within 3 business days and work with you on a fix and, if you wish, public credit.
    • Good-faith research is welcome. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and data destruction, do not degrade our services, and give us reasonable time to remediate before disclosing.
    • We do not run a bug bounty program and do not pay for reports.

    03/Ethics
    Report a concern.

    Anyone, inside or outside Origin Lab, can report suspected misconduct, fraud or policy violations anonymously. The form does not collect your email or identity.

    Submit an anonymous report