Security
Local-first isn't a feature. It's the architecture.
Om-E was designed so the interesting things never leave your machine — and so the parts that do exist in the cloud can't hurt you.
| What | Where it lives | Why it matters |
|---|---|---|
| Your knowledge bases, topics, chats | Your machine | On disk, in the app's local store. We can't read them. |
| Your model traffic (prompts, answers) | Your machine → the model provider | Direct. It never routes through our servers. |
| Your API key | Your OS keychain | Delivered once over TLS at sign-in; never in config files or logs. |
| Our cloud | Accounts, payments, key management only | Kilobytes of control traffic — no tokens, no knowledge, ever. |
Your keys never leave your machine
Om-E runs on the providers you bring — your OpenRouter key, your ChatGPT plan, your local models. Credentials live on your device, never on our servers, so there is nothing of yours we could spend, leak, or be breached for.
No company secrets in the build
Releases are gated by an automated audit: no shared API keys, no payment secrets, nothing pool-level ships in the binary. What isn't there can't be extracted.
Payments by Stripe
Checkout and card handling happen on Stripe, not on our servers. We never see or store card numbers; licences are applied by signature-verified events.
The licence is enforced by signature
The app holds a short-lived licence lease signed by our servers — edit it and the signature dies. Renewals check in periodically, and there is no bill you didn't choose: model usage is billed by your providers at their prices, never marked up by us.