Trust at Origami

Your brand is on every answer an Origami app gives, so you should know exactly how it works. This page says what we do today, and nothing we don't.

How we read websites

Public pages only. Origami reads what anyone can see. It never signs in, fills in forms or reads pages behind a login.
robots.txt is respected. Before reading any page we check the site's robots.txt and skip anything it disallows, following the rules for OrigamiBot if there are any, otherwise the rules for all crawlers.
Light touch. At most 80 pages per site, a few at a time, and only when a company's app is built or refreshed.
Clearly identified. Every request carries our user agent:

Mozilla/5.0 (compatible; OrigamiBot/0.2; +https://getorigami.io/trust#crawler)

To keep Origami out of your site entirely, add this to your robots.txt:

User-agent: OrigamiBot
Disallow: /

What we store

DataWhyWhose

Content from a company's public websiteTo answer buyers' questions with citationsThe company's, which it can ask us to delete

A log of each request to an app: session id, assistant, tool, arguments, outcomeTo show the company what buyers ask and what convertsThe company's

Name and email a buyer gives to request a follow-up, with their quoteTo pass the lead to the companyCollected on the company's behalf

Name, email and company website from our demo formTo reply to youOurs, under our privacy policy

Workspace members' email addresses and sign-in sessionsTo let the company's team sign inThe company's, managed by its owners

We use no advertising trackers or third-party analytics. The only cookie is the one that keeps customers signed in to their workspace, and we never receive the rest of a buyer's conversation with their assistant.

How long we keep it

App content, request logs and leads are kept while the app exists. Deleting an app deletes all three.
A buyer's answers during a quote are kept for 24 hours, so a conversation can pick up where it left off.
Company logos and brand colours we read for previews are cached for a day.
Messages to us are kept while we need them to help you, or until you ask us to delete them.

Infrastructure and subprocessors

We're finalising our hosting for launch. Every provider that processes customer data will be listed here, with what it does and where, before it does so.

All traffic to Origami is encrypted in transit. Leads sent to your CRM are signed so you can verify they came from us.

Certifications

Origami doesn't hold SOC 2, ISO 27001 or similar certifications yet. When an audit is underway, we'll say so here, and we won't show a badge we haven't earned. If you need a security questionnaire or a data processing agreement, our contact form and we'll work through it with you.

Contact

Found a security issue? See our security policy for how to report it. For privacy questions, see the privacy policy or reach us through our contact form.