Security
Where your data lives, how it's protected and how long we keep it
Where your data is stored
Oria's production service runs on Amazon Web Services (AWS) in the eu-north-1 region (Stockholm, Sweden). That covers the application servers, the database, file storage, the cache and the sign-in service.
Some of our service providers, including the AI model providers, may process data in other countries, including the United States. See Data processing for what they receive.
Enterprise plans can also run Oria as a private cloud deployment, with hosting and retention terms set in your agreement.
Encryption
Encryption in transit
Oria's API, account portal and PowerPoint add-in only accept connections over TLS 1.2 or 1.3, and plain HTTP requests are redirected to HTTPS. Slide previews are also delivered over HTTPS. Inside our infrastructure, the connections from Oria's servers to the database and the cache are encrypted as well.
Encryption at rest
- The database and its backups are encrypted with a key held in AWS Key Management Service, and the key is rotated every year
- Stored files, including exported decks and uploaded brand files, are encrypted with AES-256
- The cache is encrypted at rest
- Database credentials and provider API keys are kept in AWS Secrets Manager, which encrypts them
Infrastructure protection
Private database
The database sits in a private network, isn't reachable from the internet and only accepts connections from Oria's own services.
Edge network
Oria's API, account portal and add-in are served through Cloudflare's network.
Rate limits on sign-in
Requests for sign-in codes are rate limited by email address and by network address, and a sign-in attempt is locked after 5 wrong codes.
Restricted administrative access
Administrative access to production servers is limited to a short allowlist of operator network addresses. Oria's test environment is kept separate, and test systems are explicitly blocked from production file storage and production secrets.
Backups and recovery
- The database is backed up automatically every day, and backups are kept for 7 days
- The production database has deletion protection turned on
- File storage keeps backup copies of changed or deleted files for up to 30 days so they can be recovered, then deletes them permanently
Monitoring
- Oria monitors service health with its own metrics and log tools
- Automated alerts notify the Oria team about problems with the database, the cache, the application servers and sign-in
- Application logs and error reports pass through a filter that removes prompts, slide content, email addresses and credentials before anything is written
Service providers
Oria relies on a small set of service providers:
- Cloud hosting, database and storage: Amazon Web Services, in Stockholm
- Edge network: Cloudflare, in front of Oria's API, account portal and add-in
- AI models: OpenAI, Google (Gemini) and Anthropic (Claude), plus Recraft for converting images into vector graphics
- Payments: Stripe, which collects your card details directly, so Oria never stores them
- Email: Amazon Simple Email Service, which delivers your sign-in codes
- Website: Vercel hosts oria.one, website forms and analytics use HubSpot, Resend and Google Analytics, and Meta measurement runs on some public pages only if you allow it
- Academy video: Kinescope streams Oria Academy lessons
Compliance and privacy
- Our Privacy Policy explains what we collect, why, the legal bases we rely on where the GDPR or similar laws apply, and the rights you have
- Enterprise retention and data terms are set in your order form or other written agreement
- For security or privacy questions from your procurement team, contact support
How long we keep your content
How long Oria keeps your presentation content depends on your plan:
| Plan | What Oria keeps |
|---|---|
| Starter | Oria may keep the content you provide or generate, such as prompts, slides, screenshots, design options and styles, while your account is active, to power history and reuse features, support and security |
| Professional and Team | Once your slides are delivered, Oria doesn't keep your presentation content in systems it controls, except styles or reference designs you choose to save, which stay until you remove them or your account ends |
| Enterprise | Set by your order form or other written agreement |
On every plan, Oria keeps account, billing, token usage and security records, which don't contain your presentation content.
Temporary files
- Exported decks, such as the PowerPoint files Claude gives you, are stored privately, reached through download links that expire, and deleted automatically after 7 days
- Brand files you upload to set up a style are working copies: Oria deletes them automatically after setup and keeps only the style you save
Deleting your data
Delete your saved styles at any time from the PowerPoint add-in or by asking Claude. To close your account or ask us to delete your personal information, contact support. When content is deleted from the live database, it ages out of database backups within 7 days, and backup copies of files are removed within 30 days. We may keep some records longer where the law requires it, for example for tax and accounting.