Security you can actually check.
Here is the plain version of how Omie stores, isolates, and protects your data today. ISO 27001 and ISO 9001 are certified, SOC 2 Type II is in progress, and this page shows exactly where everything stands.
audited, not asserted
Certified, not claimed.
Two accredited certifications you can verify with the issuing body, and one audit we will only call done when it is.
The day SOC 2 Type II completes, this page will say certified, and not a day sooner.
what we protect, and how
What is true about your data today.
Six specifics a reviewer can hold us to, each one enforced in the product itself rather than living only in a policy document.
Encrypted end to end of the pipe
Traffic runs over TLS, and data is encrypted at rest in the database and in file storage. Keys are managed by our infrastructure providers, not sitting in application code.
Per-tenant isolation with row-level security
Every organization-scoped table carries an organization id and a Postgres row-level security policy. Isolation is enforced in the database, so one tenant can never read another tenant's rows.
Least-privilege access
People and services get only the access a job needs. Four roles (member, manager, org admin, org owner) gate what anyone can do inside an account.
EU data residency, available on Business
Business customers can keep account and learning data in an EU region. Ask us during setup and we configure it before your first user signs in.
Regular, tested backups
The database is backed up on a regular schedule with point-in-time recovery, and we test that a restore actually works rather than assuming it does.
Audit logging on sensitive actions
Role changes, exports, and admin actions are written to an append-only audit log, so there is a record of who did what and when.
One tenant, walled off in the database.
Isolation you can point to in Postgres, not a promise on a slide. Every request travels the same four steps.
Resolve the org
A request arrives and we read the active organization from the signed session, never from a URL or a header a client could forge.
Scope every query
Row-level security policies wrap each query, so the database itself returns only rows that belong to that one tenant.
Gate the action
The member's role decides what the action is allowed to do, checked on the server before anything is written.
Write the record
Sensitive changes land in an append-only audit log, so the sequence of events is there when you need to review it.
for your review
The stack, and where it runs.
The sub-processors that make Omie work, what each one touches, and where. Followed by an honest read on our compliance status.
Sub-processors
Everyone we trust with data, and exactly what they handle.
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Postgres database, authentication, and file storage | Account, learning signals, and content you create | EU region available |
| Vercel | Application hosting and edge delivery | Request metadata, no learning content stored at rest | Global edge, US control plane |
| Anthropic | Ada, the AI coach, and content generation | Prompts and lesson context, not used to train foundation models | United States |
| Resend | Transactional email such as magic links and digests | Name and email address | US and EU |
| Stripe | Billing and subscriptions | Billing details, handled inside Stripe (PCI DSS) | Global |
| PostHog | Product analytics | Pseudonymous usage events, never learning answers | EU cloud available |
| Sentry | Error monitoring, so we catch failures before you report them | Error traces and request metadata, never learning answers | US, EU available |
Compliance status
Where each item genuinely stands. We never show a certification we do not hold.
| Area | Status | What that means |
|---|---|---|
| ISO 27001 | Certified | Certified information security management. The certificate ships in the diligence pack and can be verified with the issuing body. |
| ISO 9001 | Certified | Certified quality management system covering how we build, ship, and support the product. |
| SOC 2 Type II | In progress | Controls are being implemented and evidenced. The report has not been issued yet, and we will keep this row honest until it is. |
| GDPR | Ready | Data-subject rights, a DPA, and EU residency are supported. We process only what the product needs. |
| EU data residency | Available on Business | Business accounts can keep account and learning data in an EU region, configured before go-live. |
| Data Processing Agreement | Available | A DPA is ready to sign for Business, and the standard clauses come with it. |
| Penetration test | On request | We can walk qualified reviewers through our testing approach and latest findings under NDA. |
Your data works for you, and never for an ad network or a data broker.
What we collect
Your account, your learning signals (what you finished and how you did), and the content you create. Nothing more than the product needs to personalize your day.
How long we keep it
We hold your data while your account is active so your path and mastery follow you. Deactivate the account and processing stops.
Deletion on request
Ask us and we delete your personal data, then confirm once it is done. We keep it while your account is active and clear it when you decide to go.
We do not sell your data
Omie has never sold personal data and never will. There are no ad networks and no data brokers anywhere in the picture.
sign in, your way
Sign in the way your company already does.
Business accounts connect to your identity provider through WorkOS, so people join with the login they already trust, and leave the moment their access is revoked.
- SSO and SAML through WorkOS, on Business
- SCIM provisioning to add and remove people automatically
- Multi-factor is enforced by your identity provider
- Magic link or password for everyone on Personal and Premium
identity standards we speak
- WorkOSSSO provider
- SAML 2.0enterprise sign-in
- SCIM 2.0user provisioning
- OIDCsupported
- Session securitysigned, expiring
for reviewers and researchers
Check us, and check us properly.
Found a weakness? Tell us first. We practice coordinated disclosure, aim to acknowledge good-faith reports within two business days, and we will not pursue researchers acting in good faith.
Write to security@tryomie.com. Please give us a way to reach you back.
one link, everything
The diligence pack
- ISO 27001 and ISO 9001 certificates
- This security overview, kept current
- Sub-processor list and data flows
- A DPA, ready to sign
- EU data residency options
Ten modules, one engine, one security boundary. Everything on this page covers all of them at once.