Security & Data Handling

Files uploaded to ORI

The ORI evidence upload endpoint uses memory-based file handling with a 10 MB limit. Structured files are parsed into observations and normalized entities on the server. The confirmation process uses short-lived, single-use evidence references. Do not upload credentials, secrets or unnecessary personal data.

Assessment records

Generating an ORI assessment creates a record containing organization information, supplied answers, evidence declarations and an assessment report. The current backend writes that record to server-side storage. Do not assume that leaving the browser deletes this record.

Session data and processing

Evidence-confirmation authorization is time-limited and managed in application memory. Normalized entities can remain in application memory while confirmation is pending. The deployment platform and operational monitoring may also process request metadata.

Access, retention and deletion requests

Assessment records are persisted on the application server; request metadata can appear in access logs. Uploaded evidence is parsed in application memory, and confirmation references expire after ten minutes. The current public documentation does not establish a uniform automatic deletion period for assessment records and logs.

To ask what data is held, request deletion of an assessment, or inquire about subprocessors, email [email protected]. Include the approximate assessment date and organization name, plus an assessment identifier if available. Do not include passwords or confidential exports in the email. FortiSec will need to verify that the requester is authorized before disclosing or removing records.

For a business engagement, retention terms, deletion arrangements, any applicable subprocessors and incident-notification obligations should be agreed with FortiSec before sensitive information is transferred.

Explore without real company data

Review a fictional assessment scenario or explore ORI using synthetic information. The example illustrates how evidence gaps guide follow-up checks.