Security

We take the security of your data seriously. This page summarizes the technical and organizational measures we apply to protect personal data and business content within the OIO service.

Infrastructure

• Database: Supabase (managed PostgreSQL), hosted in the EU (Ireland), with encryption at rest (AES-256).
• Compute: Cloudflare Workers at the edge, no persistent disk.
• File storage: Cloudflare R2 private buckets in the EU (Eastern Europe region). Files are accessed only via short-lived signed URLs generated server-side after authentication.
• AI processing: optional AI features send what you hand them and, for the assistant, the parts of your workspace it needs to answer (for example a project's tasks), over TLS, to our model providers: Anthropic (assistant, vision) and Groq (speech-to-text, text helpers and the assistant's fallback), both in the USA. Which provider handles a request depends on the feature. No AI provider is given standing access to your workspace.

Encryption

• All traffic is encrypted in transit using TLS 1.2 or later.
• Data at rest is encrypted by our infrastructure providers using AES-256.
• Session cookies are first-party and SameSite-restricted, and travel only over HTTPS (HSTS is enforced site-wide with preload). Cookies we issue ourselves for public share and status pages are HttpOnly and signed.

Access Control

We use authentication, server-side authorization and database row-level policies to restrict access according to account and sharing permissions. Public sharing features use the access mechanisms configured for those features.

Administrative credentials are restricted to server-side systems and authorized operational access.

Removing access prevents further authorized access through the affected permission. It cannot recall copies already downloaded. Sessions and issued links are subject to their revocation and expiry mechanisms.

Application Security

We validate accepted input fields and permissions, restrict uploads, control rich-text rendering and apply browser security policies. We use origin checks or other appropriate protections for state-changing requests, and rate limits on relevant endpoints.

These controls reduce risk; they do not guarantee that unauthorized access or other security failures are impossible. We remain responsible for the security duties imposed by our agreements and applicable law.

Operational Security

• Principle of least privilege for all internal access to production systems.
• Dependencies are kept under review; security-relevant updates are applied when an advisory affects us.
• Security patches applied promptly after disclosure.
• Access logs are retained for up to 90 days for investigation purposes.

Backups & Disaster Recovery

• Database backups run automatically every day at our infrastructure provider.
• In addition, OIO takes its own nightly snapshot of the database into separate, private storage. Each snapshot is kept for 30 days, then deleted.
• Uploaded files are copied to a separate, private backup bucket. When a file is deleted, its backup copy is removed about 30 days later.
• Backups are kept on a rolling basis, so a recent daily snapshot can be restored. They are used only for recovery and security; if we restore one, deletions made since are applied again.
• Backup data is encrypted at rest.

Incident Response

When we find a security incident, we contain it, preserve evidence, look for the cause and fix it.

When we act as a processor, we notify the relevant customer as required by the DPA. When we act as controller, we notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to people's rights and freedoms. Where notification is late, we explain why. We notify affected individuals without undue delay where required because the risk is high. We document breaches and provide further information as it becomes available.

Your Responsibility

Security is a shared responsibility. To help keep your data safe:

• Use a strong, unique password or sign in with a trusted identity provider.
• Enable two-factor authentication where supported.
• Do not share your account credentials.
• Log out on shared devices.
• Keep your email account secure, as it is used for password recovery.
• Only grant project access to people you trust.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it to security@oio.app. Do not publicly disclose the issue until we have had a reasonable opportunity to address it. We appreciate responsible disclosure and will acknowledge your contribution.

Limitations

No system is perfectly secure. While we apply industry-standard measures, we cannot guarantee that the Service will never be compromised. Our obligations and liabilities in the event of an incident are set out in our Terms of Service and Privacy Policy.