Security at Omniscient

Every memory, conversation, and personal data point is encrypted at rest using AES-256-GCM. Each user's data uses a unique encryption key. Your data is mathematically unreadable without your key.

All data moving between your device and Omniscient servers is encrypted with TLS 1.3. Older protocol versions are explicitly disabled. We enforce HSTS headers on all endpoints.

Your personal memories, conversations, and context are never used to train AI models. We use inference-only — your data improves your AI, not anyone else's. This is legally binding in our terms.

We never ask for or store your passwords to third-party services. All integrations use OAuth 2.0 with minimal permission scopes. You can revoke any connection at any time.

Omniscient collects only what it needs. You control who sees what with per-memory privacy settings. You can delete everything — instantly — with a single click.

We use Plausible Analytics — a privacy-first analytics tool that collects zero personal data, no cookies, no fingerprinting, no IP storage. We track only aggregate page views and feature usage to improve the product. Your identity is never part of any analytics event.

Every dependency in the Omniscient codebase is continuously scanned for known vulnerabilities using automated tools. Our CI/CD pipeline blocks any deployment that introduces a high-severity vulnerability.

We are actively working toward SOC 2 Type II certification. Our infrastructure and processes are being aligned with the Trust Services Criteria.