Security

This page sets out how Omne protects your data: what is in place today, and what comes next, each marked as it is.

Where Omne runs

Data location (in place). Servers and database in Germany, at Hetzner; files stored with Cloudflare in Western Europe.

The app and its database run on Omne's server at Hetzner in Germany, with Cloudflare in front of every address. The companies that process personal data for Omne, and where they do it, are on our Subprocessors page.

Content security policy (in place). A content security policy on the app and omne.so, so a page runs only the scripts Omne serves.

Encryption in transit and at rest

Encryption in transit (partly in place). HTTPS on every Omne address and HSTS on the app; TLS 1.2 as the minimum and HSTS on omne.so are next.

Encryption at rest (partly in place). Connection keys are sealed and sign-in codes stored only as hashes; encrypting the database server's disk is planned.

Sealed connection keys

Sealed connection keys (in place). Each key to a connected account is sealed with AES-256-GCM under a key kept only in the server's settings.

Workspace isolation

Workspace isolation (in place). Every request about a workspace checks that you are signed in and a member of it.

Roles

Roles (in place). Each workspace has owners, admins and members, each allowed only what their role permits.

Sign-in

Sign-in without passwords (in place). No passwords: a 6-digit code to your email, valid for 10 minutes, or Google, GitHub, LinkedIn, Facebook, Discord or Twitch.

Passkeys and two-step sign-in (planned). Passkeys and a second sign-in step, required for owners, admins and anyone connecting a bank.

Agents

Agent approvals (in place). Agents may read on their own, but every change waits for your yes, and their tools work only during a turn you started.

An agent's tools answer only to a key that exists for the one turn you started, and it ends with that turn. Changes an agent makes to Finance are recorded with the agent's name. AI and your data explains more.

Backups and recovery

Backups (planned). Database backups kept off-site in the EU, and restored on a schedule to prove they work.

Monitoring and logs

Monitoring (partly in place). Each part of Omne is checked every 10 minutes, with the results on the status page; alerts are planned.

Audit log (partly in place). Admin changes, connection events and Finance changes are recorded; retention rules and alerts are planned.

Vulnerability management and patching

Vulnerability management (planned). Dependency alerts and updates, secret and code scanning, and a yearly outside penetration test.

We aim to fix critical weaknesses within 7 days and high ones within 30 days.

Incident response and breach notice

If a personal data breach affects your data, we tell you without undue delay, and within 72 hours, as our Data Processing Agreement sets out. Our incident response policy is being written.

Vendors

Every company that processes personal data for Omne is on our Subprocessors page, under a written agreement that requires it to protect that data. Our vendor and subprocessor management policy is being written.

Compliance status

• GDPR: our Data Processing Agreement is public and part of our Terms, and Omne's data is in Germany.
• CCPA: the Data Processing Agreement includes service-provider terms.
• SOC 2: planned. This page will say it is in progress, with a date, on the day the work starts.

Report a vulnerability

If you find a security weakness in Omne, email support@omne.so with "Security" in the subject. Our vulnerability disclosure policy says what is in scope, the rules, and how we answer.