Trust center

Security, privacy and compliance.

Where clinical data is processed, how it is protected, and which agreements and external assurances are available today.

Last reviewed 11 August 2026
EU processingCustomer content stays in AWS eu-central-1.
BAA & DPASelf-serve in the console on every tier.
1–72 hour retentionConfigurable result expiry; audio deleted after processing.
No model trainingCustomer content is never used to train Omi models.
Assurance status

What is available today.

Certification status is shown as complete only after independent verification.

Request the security pack →
Available

HIPAA / BAA

Execute the published BAA in the console before sending PHI. The API uses HIPAA-eligible AWS services in the PHI path.

A BAA is a contract, not a certification.
Available

GDPR / DPA

GDPR Article 28 DPA, EU processing, SCCs and region-specific privacy addenda are published.

Omi Health B.V. is established in the Netherlands.
Planned

SOC 2 Type II

Not currently certified. Auditor engagement is the next external-assurance milestone.

We will publish status only after the engagement begins.
Evaluating

ISO/IEC 27001

Not currently certified. Formal certification is being evaluated after the SOC 2 workstream.

No ISO certification is claimed today.
Data flow

One visible processing boundary.

This scope describes the hosted Speech-to-Text Developer API. Open-model and customer-managed deployments run inside the environment you control.

1 · CustomerYour application

Sends audio over TLS using an account-scoped API key.

2 · European UnionOmi API · AWS Frankfurt

Transcription and customer-content processing remain in eu-central-1.

3 · CustomerYour transcript

Audio is deleted after processing; async results follow your selected expiry.

i

Identity is separate. Console authentication is an Omi-operated Keycloak service in the same AWS Frankfurt region and processes account and authentication data—not audio, transcripts or PHI. Cloudflare serves the website and DNS; customer API content does not transit the website CDN. Speaker diarization distinguishes anonymous speakers within one recording; it does not identify people across recordings or create persistent voice profiles.

Implemented controls

Security in the product.

Concrete controls from the production technical and organisational measures.

01

Encryption

TLS for external traffic. Customer-content stores use AWS KMS customer-managed keys with rotation.

02

Credential handling

API keys are shown once and stored as SHA-256 hashes. Service secrets live in AWS Secrets Manager.

03

Least privilege

Role-based access, scoped IAM and no standing human access to customer content.

04

Immutable audit

Content-free security and compliance events are written to KMS-protected, Object-Locked storage.

05

Tenant isolation

Keys, jobs, results and vocabulary are account-scoped, with authorization on every retrieval.

06

Data minimisation

Customer content is excluded from operational logs and backups; deletion is enforced independently.

Documents

Read the source documents.

Public terms and data-protection documents are available without a sales call.

Business Associate AgreementHIPAA contracting · self-serve execution→Data Processing AgreementGDPR Article 28 and SCCs→Sub-processorsProviders, purpose and processing location→Terms of UseService terms and customer obligations→API Privacy NoticeData categories, purposes and retention→Legal libraryRegional addenda and product-specific notices→

Need evidence for your review?

Request the enterprise security pack, report a security concern, or check current service health.

Contact securityService status