Ormeval provides decision-support intelligence derived from public sources. It is not investment, medical, legal or regulatory advice, and states nothing about the value of any security. Forward figures are deterministic model estimates, not guidance.
Trust
Last updated: 9 September 2026
Ormeval is built for a cautious audience. Browse without an account and nothing you do reaches our servers beyond the ordinary request logs every website keeps. Create an account and your setup follows you across devices, which means we hold it. Here is exactly how your data is handled either way, and how we secure the platform.
Ormeval is built entirely from public sources: SEC/EDGAR filings, ClinicalTrials.gov, openFDA, and the published notices of the FDA and other regulators. EMA and NICE records are read by a person and cited by link; they are never machine-extracted. It never uses confidential, internal, or non-public company information, and you should never enter any into it. Every reported figure traces back to a public source you can check.
Company investor-relations pages are a citation target, never a retrieval target. We link to them so you can read the primary document; no automated process fetches, parses or stores them. Where a figure exists in both an investor-relations page and a regulatory filing, we cite the filing: it is timestamped, immutable, and openly redistributable, and a webpage is none of those.
Without an account. Your cockpit, followed assets, preferences, saved events and contacts live in your browser's local storage and are not sent to or stored on our servers. You can export or delete all of it at any time from Settings. What still reaches us is what reaches any website: the request logs our host keeps, and consent-gated usage events if you allow analytics.
With an account. Signing in is what moves data to our servers, deliberately, so your setup follows you across devices and cannot be forged by editing your own browser storage. We then hold, under your user ID: your email, display name and profile; your saved cockpit configuration and follows; your team membership, shared books and annotations; and any community posts, comments and messages you write. All of it sits in our managed database provider with row-level security, and all of it is exportable and deletable from Settings. Our sub-processor list names that provider and says exactly what it holds.
Beyond that, data leaves your browser only when you explicitly ask it to:
All traffic is served over HTTPS with HSTS. The application sets a Content-Security-Policy that confines every content type to our own origin and a named allowlist, blocks plugins and embedded objects outright, and restricts where forms may post and what the page may connect to. The Content-Security-Policy permits inline scripts because the site is statically prerendered; a nonce-based policy is not applicable. All other directives are set to the most restrictive values that preserve functionality. Framing is denied by default (X-Frame-Options: DENY); the single embeddable company view (?embed=1) is same-origin only (X-Frame-Options: SAMEORIGIN) and every other request keeps framing fully blocked. The standard hardening headers ship: X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin opener/resource policies. When you sign in, authentication and any account data are handled by our managed infrastructure provider, with row-level security so you can only read or write your own records.
The full list is published, not available on request. Our sub-processor register names every provider, what each one receives, and whether it is switched on today, including the database provider that holds all account data at rest. It is linked from the footer of every page and is the authoritative version; this page does not keep a second copy to fall out of date.
Separately from sub-processors, trial and label data are retrieved from ClinicalTrials.gov (U.S. National Library of Medicine) and openFDA under their public terms. These are sources we read, not providers we send your data to.
Ormeval is not currently SOC 2 Type II certified. We complete customer security questionnaires, walk your team through our practices, and sign a mutual NDA for that purpose. For team deployments we offer admin controls, data export and a Data Processing Agreement. SSO/SAML is on the roadmap and is not available today.
Request our Data Processing Agreement or a security review by emailing hello@ormeval.com.
If you believe you have found a security issue, please email hello@ormeval.com with the details. We will acknowledge your report, keep you updated, and will not pursue action against good-faith research that respects our users' privacy and avoids service disruption.
See also our Privacy Policy, Terms of Use and Acceptable Use Policy.