Registered copyright protection
Om™ is formally registered intellectual property under UAE law.
UAE Ministry of Economy & Tourism: Copyright Certificate
What the code guarantees
These properties are verifiable from the Om™ source code: not marketing language.
Matrices Stay Off the Server After Analysis
Measurement rows are stripped before any project state is saved, so project records hold settings, results tables, annotations and report text only. A named set of server-side paths does send data: single-cell archive parsing, Olink export parsing, proteomics differential fitting, transcriptomics permutation and lncRNA work, and the metagenomics pipelines: and every one is listed in the egress table.
Institution-Scoped Isolation
Every project carries its scope: the institution, or the individual: and row-level security filters reads and writes to it. A read-only member’s save is refused by the database itself, not merely hidden in the interface. Platform administrators are the one stated exception, and reaching a customer’s project requires a declared reason.
Tamper-Evident Audit Trail
Reads, saves, project, report and figure exports, sign-ins, administrative actions, outbound reference lookups and shared-cache writes are recorded with actor, time, target and source, chained by SHA-256 so later alteration is detectable.
Vendor Access Is Never Silent
Om staff cannot open another institution’s project without declaring a reason. The access is recorded on the server before any content is returned, and appears in that institution’s audit trail.
Stripe-Secured Payments
All payments processed exclusively through Stripe with cryptographic webhook signature verification. No card data stored anywhere in Om™.
Authenticated Sessions
Token-based authentication with bounded-timeout session checks. Proper 401/403 handling and automatic redirect-to-login on expiry.
Workspace SSO
Sign-in through Google, Microsoft or Apple identity, with administrators able to enable the login methods the whole app offers. Per-institution SAML and SCIM provisioning is on the roadmap and marked as such.
HIPAA-Conscious Design
Om™ keeps measurement matrices in the browser for most workflows and writes no measurement rows into its records, which removes the bulk of the upload risk that creates HIPAA exposure on traditional cloud platforms. Data does travel to our servers on the four named paths in the egress table, so this is an architectural position rather than a certification: a Business Associate Agreement is not yet issued.
Transparent compliance overview
We tell you exactly what is verified, what is in progress, and what requires your own evaluation.
| Standard / Requirement | Status |
|---|---|
| UAE Copyright Registration | Registered |
| Measurement Matrix Containment | Verified with exceptions |
| Institution-Scoped Isolation | Verified |
| Append-Only Audit Trail | Verified |
| Audit Retention & Erasure | Verified |
| Third-Party Data Egress Disclosure | Documented |
| Stripe PCI DSS (Payments) | Delegated to Stripe |
| HIPAA Readiness | Architecture-level |
| GDPR Data Processing Agreement | Roadmap |
| SOC 2 Type II | Roadmap |
| ISO 27001 | Roadmap |
Institutional-grade security controls
For research institutions and large teams requiring additional governance.
Institution Workspaces
Owner, editor and viewer roles with a read-only mode the server enforces, invitations, and membership reconciled on every session.
Seat Counts by Agreement
Seats and storage are set per plan and confirmed in your quotation; the Enterprise tier is priced with your institution rather than per seat.
Dedicated Support
A dedicated support contact for your institution, with priority response times and direct access to the Om™ technical team.
Enterprise SSO, Uptime SLA, On-Premise, Residency, Pipeline API
Not shipped today. Per-institution SAML/SCIM sign-in, a contractual uptime SLA, private-cloud or on-premise deployment, data-residency options and a pipeline/LIMS API are all on the roadmap and marked as planned in this report and on the pricing page.
"HIPAA-conscious design" reflects Om™'s browser-native architecture that minimises data transmission risk: it is not a formal HIPAA certification, which requires a Business Associate Agreement (BAA) and organisational policy documentation. If your institution requires a formal BAA or data processing agreement (GDPR), please contact us to discuss your compliance requirements. We are transparent about what is architecturally guaranteed versus what requires third-party audit.
Security questions? We're transparent.
Our team is happy to walk through our architecture with your institution's security or compliance officer, and the full technical account is published in the architecture report.
Contact Security Team