- Data held in
- EU / US
- Report a problem
- admin@oakmonttechnologies.com
- Subprocessors
- 5
Security & trust.
How we protect your data and your compliance work.
Role-based access control
Least-privilege roles (admin, editor, client) gate every action; customers only ever see their own organisation's data.
Two-factor authentication
TOTP-based 2FA available for staff and customers, with session revocation on password change.
Encrypted in transit
All traffic is served over TLS. Secrets live in the environment, never in the codebase.
Audit trail
Mutating actions are recorded with actor, role, route and timestamp for an accountable history.
Payments handled by Stripe
Card data never touches our servers - billing is processed by Stripe (PCI-DSS Level 1).
Self-hostable / on-prem
The whole platform runs in containers and can be deployed inside your own environment for data residency.
/ Subprocessors
Everyone who can touch customer data, what they do, and where they do it. This list is part of our data-processing terms; we announce changes before they take effect.
| Processor | What it does | Where |
|---|---|---|
| Stripe Payments Europe Ltd. | Card payments and invoicing | Ireland (EU) |
| Dedicated hosting provider | Application servers, database and object storage | EU |
| Transactional email provider | Verification, password resets, job and ticket notifications | EU / US |
| PostHog, Inc. | Behaviour analytics and session replay, only with consent | USA |
| Meta Platforms Ireland Ltd. | Advertising measurement, only with consent | Ireland (EU), transfers to US |
/ Signing key
Every certificate, attestation and status feed we publish is signed with one Ed25519 key. Take the key from the address below, not from the document you are checking, and verify the compact JSON with sorted keys that the document shows as its canonical bytes.
/.well-known/oakmont-attestation-key.txt
That file carries the key and its SHA-256 fingerprint, so you can pin it once and notice if it ever changes.
/ Backups and continuity
- The database is backed up daily and kept for 30 days, with restores rehearsed rather than assumed.
- Recovery point objective: 24 hours. Recovery time objective: 8 hours for the application, 24 hours for a full rebuild.
- Deliverables in object storage are versioned, so a bad overwrite is recoverable without a database restore.
- The whole platform is defined in containers and infrastructure files, so the rebuild path is the one every deploy already takes.
/ If something goes wrong
- We investigate every report and confirm receipt to whoever sent it.
- A confirmed personal-data breach is notified to affected customers without undue delay and, where required, to the supervisory authority within 72 hours.
- Incidents that affected the service are written up on our status page, with what happened and what changed because of it.
/ Certifications, honestly
We do not hold SOC 2 or ISO 27001. We are a small team, and an audit we cannot yet resource would buy a certificate rather than a control. What we do instead is published here and testable: least-privilege roles, an audit trail of every mutating action, two-factor authentication, encrypted secrets, a documented threat model, and a security contact that answers. If your procurement requires a certificate, say so at the start rather than at the end.
/ For procurement
We complete vendor security questionnaires, sign NDAs, and provide a data-processing agreement built on the EU standard contractual clauses. Ask and we send the current documents the same week.
Talk to us/ Report a vulnerability
Found a vulnerability? Email admin@oakmonttechnologies.com - we appreciate responsible disclosure.
Security review or DPA?
We support vendor security questionnaires, data-processing agreements and NDAs for enterprise procurement.