OMMO Analytics Security

Our application servers run at Hetzner in Nuremberg, Germany. Your data is stored in a Postgres database run by Neon on AWS in Frankfurt, Germany. Until we retire it, a backup copy from our previous hosting is held by Neon in the United States (Virginia). Nothing is hosted in Saudi Arabia. The service providers we use are listed in the privacy policy.

Every connection to OMMO is encrypted with TLS (HTTPS). Our database provider, Neon, encrypts stored data. Store and ad-account credentials are encrypted with AES-256-GCM before they are saved, using a data key unique to your workspace. That key is itself encrypted with a master key kept outside the database.

Every page and action in the app is limited to the workspace you are signed in to. OMMO staff can open your workspace in a read-only view to support onboarding and answer your requests.

OMMO only reads from connected platforms. Shopify and Google Analytics connect with read-only permissions. Other platforms, including Salla, Zid, Google Ads, Meta, TikTok and Snapchat, can grant broader permissions when you connect; OMMO uses them only to read. When you disconnect a source in the app, or uninstall OMMO from Salla or Zid, OMMO deletes its stored credentials and stops syncing it.

Passwords are hashed with bcrypt. Two-step sign-in with an authenticator app is available to every user. Session cookies are signed, HTTP-only and sent over HTTPS only. Sign-in attempts are rate-limited per IP address and per email.

Card payments made to OMMO go through Stripe's hosted checkout; OMMO never sees or stores your card number.

Email security@ommoco.com with details. We reply within one business day. We do not pursue legal action against good-faith researchers.

OMMO does not hold a third-party security certification yet. Workspace owners and admins can export the latest 5,000 activity-log entries as CSV.