Security and privacy that pass your review
Before a new tool gets the go-ahead, data protection officers, IT security and works councils take a close look. That review is what omul is built to pass: EU hosting or self-hosting, no participant accounts, no third-party trackers — and open source that makes security verifiable instead of just claimed.
No credit card · Free self-hosting · Open source (AGPLv3)
Security at a glance
What reviewers find in omul
The six points that land on the table first in almost every security and privacy review — and how omul answers them.
Hosting in the EU or on your side
Run omul in an EU data center or entirely on your own infrastructure. You choose the jurisdiction — and the data does not leave it.
Data-minimal by default
The audience joins with a 6-digit code — no email, no login, no device fingerprint. We build no profiles and recognise nobody across sessions; whether personal data arises at all is decided by the questions you ask.
DPA on request
For the hosted option we provide a data processing agreement (DPA) — on request ahead of launch. With self-hosting you are the sole controller, with no processor involved.
Deleting is in your hands
You delete whenever you want, with no support ticket and no waiting. No secondary use, no sharing with third parties — what's deleted is gone.
No third-party trackers
No Google Analytics, no ad pixels, no hidden scripts. If any usage measurement happens at all, it's cookieless and self-hosted.
Verifiable, not a black box
The source code is open (AGPLv3). Security can be reviewed independently — by your team, by auditors, by the community.
Sub-processors
Few, transparent, available on request
The fewer parties involved, the smaller the attack surface and the simpler the review. That's why we keep the list of sub-processors as short as possible — and disclose it rather than hide it.
- With self-hosting there are no sub-processors — you run everything yourself.
- For the hosted option we limit ourselves to the essentials: the EU hosting provider and a delivery service for account emails.
- You get the current list on request; the DPA lists it bindingly.
- New sub-processors are not added quietly — changes are documented.
Deletion concept
How data goes away again
A security concept is only complete once it's clear how data disappears again. With omul that path is short and stays in your hands.
- 1
You delete it yourself, right away
Results stay until you delete them — and that you can do yourself at any time, with no support ticket and no waiting. A configurable automatic retention period is on the roadmap.
- 2
Delete when you want
Deleting means deleting: a presentation takes every answer, every Q&A question, every chat message and every collected name with it. A reset clears every contribution from a run immediately.
- 3
No secondary use
Your data is never sold, used for advertising or shared with third parties. A detailed deletion concept is available on request.
Open source
Security you can read
Open source under the AGPLv3 is what makes omul checkable rather than merely trustworthy. Your security team doesn't have to trust our claims — it can review the code itself. No black box, no hidden data paths, no surprises in the next update.
Responsible disclosure
Found a vulnerability? Here's how to report it
Security is an ongoing process. If you discover a security issue, please report it confidentially rather than in public, by either of two routes: by email to hallo@omul.app with "omul security" in the subject line, or through GitHub's private vulnerability reporting on the binaryplease/omul repository (you need a GitHub account for that).
Frequently asked questions about security & privacy
Where is data hosted?
Wherever you want: in an EU data center or on your own infrastructure (self-hosting). You choose the jurisdiction, and the data does not leave it — full data sovereignty, no vendor lock-in.
Is there a DPA?
For the hosted option we provide a DPA — on request ahead of the official launch. With self-hosting you process the data yourself and remain the sole controller, so no processor is involved.
Which sub-processors do you use?
With self-hosting, none. For the hosted option we deliberately keep the list short: the EU hosting provider and a delivery service for account emails — address confirmation, password reset, address change. Presentation content and participant data are never sent to that delivery service. The binding list is in the DPA, and you get it on request.
How is data deleted?
You delete it yourself, at any time and without a support ticket. Deleting means deleting: a presentation takes every answer, every Q&A question, every chat message and every collected name with it, and a reset clears every contribution from a run immediately. A configurable automatic retention period is on the roadmap. Deleted data is not reused or shared with third parties; a detailed deletion concept is available on request.
Do you use trackers or analytics?
No third-party trackers, no Google Analytics, no ad pixels. If any usage measurement happens at all, it's cookieless and self-hosted — no data flows to ad networks. omul itself loads nothing from other people's servers; embed a video or someone else's board in a slide and your participants' devices connect to that provider. That is your call, slide by slide.
How do I report a vulnerability?
Confidentially, not in public — by either of two routes: by email to hallo@omul.app with "omul security" in the subject line, or through GitHub's private vulnerability reporting on the binaryplease/omul repository (the "Security" tab, "Report a vulnerability"; you need a GitHub account for that).
Security you can verify
Check omul yourself — the code is open
Start a live poll in under a minute, or hand the code to your security team. No credit card, no setup.
No credit card · Free self-hosting · Open source (AGPLv3)