Security & data protection.

This page covers the specific technical and organisational controls relevant to enterprise procurement. It supplements our general security page and Data Processing Agreement.

Encryption at rest

All customer data is stored in a managed PostgreSQL cluster operated by Supabase on AWS (eu-central-1 and eu-west-1). Storage volumes are encrypted with AES-256. Encryption keys are managed by AWS KMS with automatic annual rotation. Backup snapshots use separately managed keys and are stored across two EU regions.

Encryption in transit

Every connection between end users, the Vercel edge network, and our backend uses TLS 1.3. Older TLS versions (1.0, 1.1) are disabled. HTTP traffic is redirected to HTTPS on all endpoints. Internal service-to-service calls (e.g., from the application server to Supabase) also use TLS.

Supported cipher suites: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256

Backup & recovery

Supabase performs automated daily database snapshots, retained for 30 days. Point-in-time recovery is enabled with a recovery point objective (RPO) of 5 minutes.

Backups are verified monthly via automated restore tests into an isolated environment. Recovery time objective (RTO) is under 4 hours for a full restore from snapshot.

Incident response

Omie maintains a written Incident Response Plan (IRP). The on-call rotation covers 24/7 via PagerDuty escalation. Severity classifications:

In the event of a Personal Data breach (Art. 33 GDPR), Omie notifies affected Controllers within 48 hours of confirmation. Notifications are sent to the technical contact registered in the account and to the email on file. Report format follows ENISA guidelines.

To report a suspected incident: security@tryomie.com. Responsible disclosure participants are credited in our hall of fame.

Access controls

Row-Level Security (RLS) is enabled on every table in the database. Tenant data is fully isolated at the query layer — no application-level tenant filtering that could be bypassed. Production database credentials are stored in a secrets manager and rotated annually. Admin console access requires MFA and is logged to an immutable audit trail.

Compliance certifications

Omie is in the process of achieving ISO 27001 certification (target: Q4 2026) and SOC 2 Type II (target: Q1 2027). In the interim, customers can request our self-assessment questionnaire (SAQ) covering the SOC 2 trust service criteria.

Our primary cloud provider Supabase (AWS infrastructure) is ISO 27001, SOC 2 Type II, and PCI DSS certified. Vercel (hosting) is SOC 2 Type II certified. Certificates are available upon request.

Questions & review

For InfoSec questionnaires, penetration test summaries, or security review calls, contact: security@tryomie.com. Enterprise customers can request a dedicated security review session.