How Ottomatt Works

Ottomatt is a multi-service platform, not a monolithic application. Each business capability runs as an independent service with its own database schema, API surface, and deployment lifecycle. Services communicate through well-defined contracts and shared event buses.

• Dedicated agent runtime per tenant. No shared inference, no prompt leakage between businesses.
• Microservice architecture with independent scaling. Business intelligence, communication, and automation run as separate services.
• Proprietary model routing layer selects the right model for each task based on complexity, language, and latency requirements.
• Event-driven processing with persistent job queues. No work is lost if a service restarts.
• Full Hebrew and RTL support at the platform level, not bolted on as localization.

Every service enforces tenant isolation at the database level. Row-level security policies ensure that one business can never access another's data, even in the event of an application-level bug.

Security is structural, not cosmetic. Tenant isolation is enforced at the database layer, not just the application layer.

• Row-Level Security (RLS) on all tenant tables. Every query is scoped by tenant ID at the database level, enforced by PostgreSQL policies.
• Non-superuser service connections. Application services connect with restricted database roles that cannot bypass RLS.
• AES-256 encryption at rest for all sensitive data. TLS 1.3 in transit.
• OAuth2 with scoped token permissions for all third-party integrations. Tokens are encrypted and tenant-isolated.
• No training on tenant data. Business data is never used to train, fine-tune, or improve AI models.
• PII scanning in CI/CD pipeline. Secrets and personal data are blocked before code reaches production.
• Automated dependency scanning and CVE detection across all services in CI/CD.

We treat every tenant boundary as a hard security boundary, not a soft filter.

Ottomatt connects to businesses through official platform APIs only. We do not use unofficial protocol bridges, reverse-engineered clients, or browser automation to access messaging platforms.

• WhatsApp Business API (official Meta integration). Verified business profiles, message templates, and full compliance with Meta's commerce policies.
• Telegram Bot API for businesses that prefer Telegram.
• Webhook-based event system for custom integrations.
• All channel connections are tenant-scoped. Each business has its own verified identity and message history.

Each tenant gets a dedicated AI agent that understands their specific business context. Agents are not generic chatbots with a system prompt. They are domain-aware automation workers with access to real business data and tools.

• Per-tenant agent isolation. Each agent has its own memory, tool permissions, and conversation context.
• Proprietary model routing. The platform selects the optimal model for each task. Tenants never interact with raw LLM APIs.
• Tool-based execution. Agents take real actions: send messages, update inventory, schedule deliveries, generate reports.
• Persistent memory across conversations. Agents remember business context, customer preferences, and operational patterns.
• Multi-language native processing. Hebrew, Arabic, English, and Russian are handled natively, not through translation layers.
• Human-in-the-loop controls. Businesses can define which actions require approval and which run autonomously.

The agent is not a feature. It is the interface. Every business capability is accessible through natural conversation.

Ottomatt integrates with the tools Israeli businesses already use. All integrations are official API connections, tenant-scoped, and permission-gated.

• Google Workspace: Gmail, Calendar, Drive with OAuth2 consent.
• Accounting and invoicing systems used in the Israeli market.
• Delivery and logistics coordination.
• Inventory and POS systems.
• Custom webhook endpoints for any system with an API.
• SEO and web presence management with automated auditing.

Your business data stays yours. Our data handling is designed around a simple principle: tenant data is never shared, never used for training, and always deletable.

• Tenant data is logically isolated at the database level with enforced row-level security.
• No cross-tenant data sharing or aggregation. Business A cannot influence or access Business B's data.
• Full data export available on request. Standard formats, no lock-in.
• Data deletion is real deletion, not soft-delete with indefinite retention.
• AI model providers receive only the minimum context needed for each task. No bulk data transfers.
• Compliant with Israeli Privacy Protection Law (5741-1981) and GDPR principles.

Ottomatt exposes a structured API for businesses that want programmatic access to their automation. All endpoints are authenticated, tenant-scoped, and rate-limited.

• RESTful endpoints for business data: contacts, orders, inventory, scheduling.
• Webhook subscriptions for real-time event notifications.
• Agent interaction API for sending tasks and receiving results programmatically.
• Health and status endpoints for monitoring integrations.
• All responses follow consistent schema patterns with proper error codes.