oio

Security

Last updated: 2026-04-19

We take the security of your data seriously. This page summarizes the technical and organizational measures we apply to protect personal data and business content within the OIO service.

Infrastructure

  • Database: Supabase (managed PostgreSQL) with encryption at rest (AES-256).
  • Compute: Cloudflare Workers at the edge, no persistent disk.
  • File storage: Cloudflare R2 private buckets. Files are accessed only via short-lived signed URLs generated server-side after authentication.
  • AI processing: optional AI features send only the content you hand them, over TLS, to our model providers: Anthropic (assistant, vision), DeepSeek (the assistant's cost fallback) and Groq (speech-to-text). Which provider handles a request depends on the feature. No AI provider is given standing access to your workspace.

Encryption

  • All traffic is encrypted in transit using TLS 1.2 or later.
  • Data at rest is encrypted by our infrastructure providers using AES-256.
  • Session cookies are first-party and SameSite-restricted, and travel only over HTTPS (HSTS is enforced site-wide with preload). Cookies we issue ourselves for public share and status pages are HttpOnly and signed.

Access Control

  • Row-level security (RLS) at the database layer. The browser only ever reaches the database through a key that can see nothing but the rows its policies allow. A user cannot query another user's data by design.
  • Shared access via sharing groups uses explicit permission tiers (viewer, editor, manager, owner). Revoking group membership immediately revokes all derived access.
  • Server-side authorization on every API route: no client-trusted permission checks.
  • Service-role credentials are used only in server-side code with scoped ownership verification; they are never exposed to the browser.

Application Security

  • CSRF protection via same-origin enforcement on all state-changing requests.
  • Input sanitization and strict allowlists for API payloads. Mass assignment is not possible.
  • Content Security Policy (CSP) restricting script and image sources.
  • Rate limiting on mutating endpoints to prevent abuse.
  • File upload restrictions: MIME-type allowlist, size caps, filename sanitization, SVG explicitly blocked (XSS vector).
  • Rich-text rendering goes through a single controlled pipeline: user input is fully HTML-escaped first, and only our own fixed set of tags is then re-inserted. Link and image targets are restricted to https or the app's own authenticated file route, so schemes such as javascript: and data: cannot get through; external links carry noopener, noreferrer and nofollow.

Operational Security

  • Principle of least privilege for all internal access to production systems.
  • Dependencies are kept under review; security-relevant updates are applied when an advisory affects us.
  • Security patches applied promptly after disclosure.
  • Access logs are retained for up to 90 days for investigation purposes.

Backups & Disaster Recovery

  • Database backups run automatically every day at our infrastructure provider.
  • Backups are kept on a rolling basis, so a recent daily snapshot can be restored.
  • Backup data is encrypted at rest.

Incident Response

We maintain an incident response process. In the event of a confirmed personal data breach likely to result in risk to users' rights, we will:

  1. Contain the incident and preserve evidence.
  2. Notify the relevant supervisory authority within 72 hours (GDPR Art. 33).
  3. Notify affected users without undue delay where the breach is likely to result in a high risk to their rights.
  4. Conduct a root-cause analysis and remediate.

Your Responsibility

Security is a shared responsibility. To help keep your data safe:

  • Use a strong, unique password or sign in with a trusted identity provider.
  • Enable two-factor authentication where supported.
  • Do not share your account credentials.
  • Log out on shared devices.
  • Keep your email account secure, as it is used for password recovery.
  • Only grant project access to people you trust.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it to security@oio.app. Do not publicly disclose the issue until we have had a reasonable opportunity to address it. We appreciate responsible disclosure and will acknowledge your contribution.

Limitations

No system is perfectly secure. While we apply industry-standard measures, we cannot guarantee that the Service will never be compromised. Our obligations and liabilities in the event of an incident are set out in our Terms of Service and Privacy Policy.