01Overview
audited, not asserted
02Certified, not claimed .
Two accredited certifications you can verify with the issuing body, and one audit we will only call done when it is.
Get the certificates in the pack →
The day SOC 2 Type II completes, this page will say certified, and not a day sooner.
what we protect, and how
03What is true about your data today .
Six specifics a reviewer can hold us to, each one enforced in the product itself rather than living only in a policy document.
Encrypted end to end of the pipe
Traffic runs over TLS, and data is encrypted at rest in the database and in file storage. Keys are managed by our infrastructure providers, not sitting in application code.
Per-tenant isolation with row-level security
Every organization-scoped table carries an organization id and a Postgres row-level security policy. Isolation is enforced in the database, so one tenant can never read another tenant's rows.
Least-privilege access
People and services get only the access a job needs. Four roles (member, manager, org admin, org owner) gate what anyone can do inside an account.
EU region (Frankfurt): planned
Today all data is hosted in N. Virginia, USA (AWS us-east-1). Our Europe region in Frankfurt, Germany (AWS eu-central-1) is planned, and Business customers can ask to move there once it opens.
Regular, tested backups
The database is backed up on a regular schedule with point-in-time recovery, and we test that a restore actually works rather than assuming it does.
Audit logging on sensitive actions
Role changes, exports, and admin actions are written to an append-only audit log, so there is a record of who did what and when.
04One tenant, walled off in the database.
Isolation you can point to in Postgres, not a promise on a slide. Every request travels the same four steps.
Resolve the org
A request arrives and we read the active organization from the signed session, never from a URL or a header a client could forge.
Scope every query
Row-level security policies wrap each query, so the database itself returns only rows that belong to that one tenant.
Gate the action
The member's role decides what the action is allowed to do, checked on the server before anything is written.
Write the record
Sensitive changes land in an append-only audit log, so the sequence of events is there when you need to review it.
for your review
05The stack, and where it runs .
The sub-processors that make Omie work, what each one touches, and where. Followed by an honest read on our compliance status.
Sub-processors
Everyone we trust with data, and exactly what they handle.
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Postgres database, authentication, and file storage | Account, learning signals, and content you create | N. Virginia, USA (us-east-1); Frankfurt planned |
| Vercel | Application hosting and edge delivery | Request metadata, no learning content stored at rest | Global edge, US control plane |
| Anthropic | Ada, the AI coach, and content generation | Prompts and lesson context, not used to train foundation models | United States |
| Resend | Transactional email such as magic links and digests | Name and email address | US and EU |
| Stripe | Billing and subscriptions | Billing details, handled inside Stripe (PCI DSS) | Global |
| PostHog | Product analytics | Pseudonymous usage events, never learning answers | EU cloud available |
| Sentry | Error monitoring, so we catch failures before you report them | Error traces and request metadata, never learning answers | US, EU available |
| OpenAI | Search and recommendation embeddings, and text-to-speech for audio lessons | Search text and onboarding answers as text; lesson scripts for audio. Not used to train models | United States |
| ElevenLabs | Voice narration of lessons | Lesson text only, no personal data | United States |
Compliance status
Where each item genuinely stands. We never show a certification we do not hold.
| Area | Status | What that means |
|---|---|---|
| ISO 27001 | Certified | Certified information security management. The certificate ships in the diligence pack and can be verified with the issuing body. |
| ISO 9001 | Certified | Certified quality management system covering how we build, ship, and support the product. |
| SOC 2 Type II | In progress | Controls are being implemented and evidenced. The report has not been issued yet, and we will keep this row honest until it is. |
| GDPR | Ready | Data-subject rights and a DPA are supported, and the EU region is planned. We process only what the product needs. |
| EU region (Frankfurt) | Planned | Business accounts will be able to keep account and learning data in Frankfurt, Germany (AWS eu-central-1). Today all data is in N. Virginia, USA (AWS us-east-1). |
| Data Processing Agreement | Available | A DPA is ready to sign for Business, and the standard clauses come with it. |
| Penetration test | On request | We can walk qualified reviewers through our testing approach and latest findings under NDA. |
Your data works for you , and never for an ad network or a data broker.
What we collect
Your account, your learning signals (what you finished and how you did), and the content you create. Nothing more than the product needs to personalize your day.
How long we keep it
We hold your data while your account is active so your path and mastery follow you. Deactivate the account and processing stops.
Deletion on request
Ask us and we delete your personal data, then confirm once it is done. We keep it while your account is active and clear it when you decide to go.
We do not sell your data
Omie has never sold personal data and never will. There are no ad networks and no data brokers anywhere in the picture.
sign in, your way
06Sign in the way your company already does.
Business accounts connect to your identity provider through WorkOS, so people join with the login they already trust, and leave the moment their access is revoked.
- SSO and SAML through WorkOS, on Business
- SCIM provisioning to add and remove people automatically
- Multi-factor is enforced by your identity provider
- Magic link or password for everyone on Personal and Premium
identity standards we speak
- WorkOS SSO provider
- SAML 2.0 enterprise sign-in
- SCIM 2.0 user provisioning
- OIDC supported
- Session security signed, expiring
for reviewers and researchers
07Check us, and check us properly .
Found a weakness? Tell us first. We practice coordinated disclosure, aim to acknowledge good-faith reports within two business days, and we will not pursue researchers acting in good faith.
Report a vulnerability → (security@tryomie.com)
Write to security@tryomie.com. Please give us a way to reach you back.
one link, everything
The diligence pack
- ISO 27001 and ISO 9001 certificates
- This security overview, kept current
- Sub-processor list and data flows
- A DPA, ready to sign
- EU region (Frankfurt): planned
Ten modules, one engine, one security boundary. Everything on this page covers all of them at once.
Contact us (hello@tryomie.com)
08Encryption at rest
All customer data is stored in a managed PostgreSQL cluster operated by Supabase on AWS in N. Virginia, USA (us-east-1). Our Europe region in Frankfurt, Germany (eu-central-1) is planned. Storage volumes are encrypted with AES-256. Encryption keys are managed by AWS KMS with automatic annual rotation. Backup snapshots use separately managed keys and are stored in the same region as the database (us-east-1).
09Encryption in transit
Every connection between end users, the Vercel edge network, and our backend uses TLS 1.3. Older TLS versions (1.0, 1.1) are disabled. HTTP traffic is redirected to HTTPS on all endpoints. Internal service-to-service calls (e.g., from the application server to Supabase) also use TLS.
Supported cipher suites: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
10Backup & recovery
Supabase performs automated daily database snapshots, retained for 30 days. Point-in-time recovery is enabled with a recovery point objective (RPO) of 5 minutes.
Backups are verified monthly via automated restore tests into an isolated environment. Recovery time objective (RTO) is under 4 hours for a full restore from snapshot.
11Incident response
Omie maintains a written Incident Response Plan (IRP). The on-call rotation covers 24/7 via PagerDuty escalation. Severity classifications:
| Severity | Definition | Triage SLA |
|---|---|---|
| SEV-1 | Data breach, full platform outage | < 1 hour |
| SEV-2 | Partial outage, degraded data access | < 4 hours |
| SEV-3 | Non-critical bug, cosmetic issue | Next business day |
In the event of a Personal Data breach (Art. 33 GDPR), Omie notifies affected Controllers within 48 hours of confirmation. Notifications are sent to the technical contact registered in the account and to the email on file. Report format follows ENISA guidelines.
To report a suspected incident: security@tryomie.com . Responsible disclosure participants are credited in our hall of fame.
12Access controls
Row-Level Security (RLS) is enabled on every table in the database. Tenant data is fully isolated at the query layer: no application-level tenant filtering that could be bypassed. Production database credentials are stored in a secrets manager and rotated annually. Admin console access requires MFA and is logged to an immutable audit trail.
13Compliance certifications
Omie holds ISO 27001 and ISO 9001 certification. SOC 2 Type II is in progress. In the meantime, customers can request our self-assessment questionnaire (SAQ) covering the SOC 2 trust service criteria.
Our primary cloud provider Supabase (AWS infrastructure) is ISO 27001, SOC 2 Type II, and PCI DSS certified. Vercel (hosting) is SOC 2 Type II certified. Certificates are available upon request.
14Questions & review
For InfoSec questionnaires, penetration test summaries, or security review calls, contact: security@tryomie.com . Enterprise customers can request a dedicated security review session.
GDPR
security@tryomie.com (security@tryomie.com)
Contact us (hello@tryomie.com)