Security at Ortelan

1. About this page

This page gives a general overview of how Ortelan Holdings LLC ("Ortelan," "we," "us" or "our") approaches security. Specific commitments to clients are set out in their agreements. Commitments for Praus, Lost Tribes and other products are set out in each product’s own documentation and terms.

This page is for information only. It does not create any warranty, representation or contractual obligation, and it does not modify any agreement. Our practices change as systems, risks and standards change. This version takes effect on October 27, 2026.

2. General safeguards

We use administrative, technical and physical safeguards designed to protect information, taking into account its nature and the relevant risks. No website, service or method of transmission is completely secure. We do not guarantee that unauthorized access, loss, disruption or other incidents will never occur.

3. Scope of commitments

Security, data handling, availability and incident-notification commitments for a particular product or engagement are governed by the applicable agreement and law. General descriptions on this website do not create additional warranties, service levels or contractual commitments.

We respond to security incidents and provide notifications as required by applicable law and our agreements.

4. Confidential information and inquiries

We do not publish confidential details of our systems, safeguards or internal procedures. Organizations evaluating an engagement may contact us about available security information. Any disclosure is subject to appropriate confidentiality arrangements and does not authorize access to or testing of our systems.

5. Report a vulnerability

If you believe you have found a security vulnerability in an Ortelan website or system, email security@ortelan.com. Please include a description of the issue, the steps to reproduce it, the affected URL or component, and any proof-of-concept.

Scope

This policy covers websites and systems operated by Ortelan. Products may publish their own policies, but reports about them are also welcome here. Systems run by third parties, including our service providers, are out of scope. Report issues in those systems to their owners.

Rules of engagement

You must not:

• run denial-of-service tests, high-volume automated scans, or anything else that degrades service;
• use social engineering, phishing or physical attacks against Ortelan, its people or its clients;
• access, change, delete or keep data that is not yours, beyond the minimum needed to show the vulnerability; or
• use a vulnerability for any purpose other than confirming and reporting it.

If you encounter data that is not yours, stop, tell us, and delete any copies you have. Keep the details confidential until we have fixed the issue and agreed with you on any disclosure.

What you can expect

We will acknowledge your report, investigate it, and keep you informed of our progress. If you would like, we will credit you once the issue is resolved. Any reward is at our sole discretion, and reporting does not entitle you to payment.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not bring legal action against you for it, and we will not ask law enforcement to do so. This does not apply to activity that breaks these rules or the law. We cannot authorize testing of systems owned by third parties.

You must not be on a sanctions list or in a sanctioned country. Ortelan employees and contractors should report through internal channels.

6. Phishing and impersonation

Ortelan will never ask you for your password, a one-time code or payment by email, text or phone. If you receive a suspicious message that claims to come from Ortelan or one of our people, do not act on it, and report it to us.

7. Contact

For security questions, email security@ortelan.com or use our contact page.