Credentials
Trust & credentials
What we can show you about how OtomoAI operates: marks verified by an outside body, scans anyone can re-run live, statements we make about ourselves, and one pledge to a named third party. Each links to the full page behind it.
Zero Data Retention
What 'zero data retention' means for the AI systems behind your automation, and what we can and can't promise today.
Attested by: OtomoAI, about its own practice
Read the Zero Data Retention page
Personal Data Protection Act
Names the Malaysian law we operate under — not a certification, since no body in Malaysia certifies PDPA compliance.
Attested by: OtomoAI, about its own practice
WCAG 2.2 AA
Our accessibility conformance target and how we evaluate it — reviewed by us, not audited by an outside body.
Attested by: OtomoAI, about its own practice
Read the Accessibility Statement
Responsible disclosure
A published RFC 9116 security.txt with a monitored contact and the rules for reporting a vulnerability to us in good faith.
Attested by: OtomoAI, about its own practice
OWASP ASVS 5.0 Level 1
A line-by-line self-assessment of the dashboard app against all 70 Level 1 requirements, with the status of each one published, including the ones that do not pass yet.
Attested by: OtomoAI, about its own code
Email authentication and DNSSEC
SPF, DKIM and DMARC records so mail claiming to be from otomoai.com.my can be checked, and a DNSSEC-signed zone so the answers cannot be swapped in transit. Public DNS records anyone can query.
Attested by: public DNS, scored by internet.nl
Internet.nl website test, 100%
The Dutch Internet Standards Platform's open test of a website's modern standards: IPv6, DNSSEC, TLS 1.3 only, HTTPS, security headers, RPKI and security.txt. otomoai.com.my passes every check; anyone can re-run it.
Attested by: Internet.nl, test 4299470 on 15 Sep 2026