Security
Security that is on from day one
PolyOmi runs on your own server, and the protection is built in rather than bolted on. Personal data is encrypted, sign-ins are guarded, every important action is logged, and updates and backups are designed to fail safely.
Join the waiting listContact us
- Self-hosted
- Encrypted personal data
- Your data on your own server
- Personal data encrypted in the database
- Two-step verification
- 0 tracking cookies in analytics
Your data
Your data stays yours
-
Self-hosted
PolyOmi runs on ordinary hosting with PHP and MariaDB/MySQL. You choose the host and where your data lives.
-
Hidden staff address
Staff sign in at a secret address that nothing on the public site links to. Visitors see only your logo and a short text.
-
Encrypted personal data
Names, e-mails, phone numbers, messages, notes, HR records and other free text are encrypted in the database with libsodium.
-
No plain-text lookups
E-mail lookups use a keyed hash, never the plain address.
-
Cookie-free analytics
Website analytics without cookies and without stored IP addresses, so no consent banner is needed for it.
-
Built with GDPR in mind
Encryption, access control and an audit log help you protect the personal data you are responsible for.
Sign-in protection
Attackers get blocked, you don't get locked out
Turn on two-step verification with any authenticator app, and require it for the roles you choose. Repeated failed logins block the attacker's IP address.
Accounts themselves are never locked, so an attacker cannot lock you out of your own system. A separate per-account brake slows down password guessing spread across many IP addresses.
- Two-step verification, required per role if you like
- IP blocking after repeated failures
- Per-account brake against distributed guessing
- Password asked again for updates, backups, restores, key display and deleting users
Roles and permissions
Everyone sees only what they should
Start from the built-in roles (Manager, Admin, Moderator, User and Client) or create your own. A permission matrix covers every function. Groups add extra permissions and decide which brands, projects and departments people can see.
Nobody can grant rights they do not hold themselves.
- Built-in and custom roles
- Permission matrix for every function
- Groups that limit access to brands, projects and departments
Audit log
Who did what, and when
Every important action is recorded with user, time and IP address. Search the log when you need to know what happened, and export it to CSV.
- User, time and IP address on every entry
- Searchable
- Export to CSV
Updates
Updates that roll back on failure
Upload a full or partial update package. PolyOmi checks it first and shows exactly what will change. Before anything is replaced, it takes a snapshot of files and database. If something fails, it rolls back automatically, even if the new code cannot start.
- Package checked before install
- Snapshot of files and database
- Automatic rollback
Backups
Backups you can actually restore
Complete backups of database, files and settings run in small steps, so they work on shared hosting and resume if interrupted. Backups are stored outside the web root. Set daily or weekly schedules and retention rules, and restore from the panel or the command line.
Automatic weekly copies go off-site to S3-compatible storage (such as AWS, Hetzner, Scaleway or Backblaze) or to FTP, FTPS or SFTP, with optional AES-256 encryption using your own passphrase.
- Resumable backups that work on shared hosting
- Stored outside the web root
- Off-site copies with optional AES-256 encryption
Responsible disclosure
If you believe you have found a security issue in PolyOmi, please tell us privately at info@polyomi.com before sharing it with anyone else.
Please include:
- the PolyOmi version you tested
- what you found and why it matters
- the steps to reproduce it
Only test against an installation you own or have permission to test, and do not access, change or delete data that is not yours. Give us reasonable time to investigate and release a fix before you publish anything. We will reply as soon as we can and keep you updated while we work on it.
Questions about security
Where is my data stored?
On the server where you install PolyOmi. You choose the hosting provider and the location. When PolyOmi Cloud launches, it will be an option for those who prefer not to run a server themselves.
Who is responsible for the server?
With the self-hosted version, you or your hosting provider look after the server itself. PolyOmi adds application security on top: encryption, sign-in protection, permissions, audit log, safe updates and backups.
Can an attacker lock me out with failed logins?
No. Failed logins block the attacker's IP address, not the account. A separate per-account brake slows down guessing from many addresses without locking the real owner out.
What happens if an update fails?
PolyOmi snapshots files and database before updating and rolls back automatically if anything fails, even if the new code cannot start.
Is PolyOmi GDPR certified?
There is no certification. PolyOmi is built with GDPR in mind: personal data is encrypted in the database, access is controlled by roles and groups, and important actions are logged. As the company using it, you remain responsible for how you process personal data.
Run your company on a system you control
PolyOmi is in closed beta. Join the waiting list, or contact us if you have questions about security.