FAQs about security and privacy.
How Onremo protects your data, what GDPR/KVKK compliance means, who can see what, and how to harden your account.
-
How is my data protected?
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Onremo servers are hosted in ISO 27001-certified data centers. Access is logged and audited.
-
Is Onremo GDPR compliant?
Yes. We're a data processor under GDPR. You retain ownership of your data, can request export or deletion at any time, and we sign DPAs with business customers on request.
-
Who can see my data?
Only you and team members you grant access to. Onremo employees don't access your data except in narrow support situations, and only with your explicit permission per session.
-
What happens to my data if I delete my account?
Your data is removed from active systems within 7 days. Backups are purged within 30 days. After that, no recovery is possible. You can download all your data before deletion.
-
Does Onremo train AI on my data?
No. Your data is never used to train AI models — neither Onremo's nor any third-party's. AI features (when present) process your data only when you explicitly trigger them, and the data isn't retained for training.
-
Can I enable 2FA?
Yes, and you should. Account → Security → Enable 2FA. We support TOTP-based 2FA (Google Authenticator, 1Password, Authy). SMS 2FA is not recommended due to SIM swap risk. Detail: enabling 2FA guide.
-
Can I require 2FA for my whole team?
Yes. Account → Team → 'Require 2FA for all members.' Existing members have 7 days to enable; after that they can't log in until they do.
-
What does Onremo do during a security incident?
Affected customers are notified within 72 hours. The incident is investigated, root cause documented, and remediations applied. Public post-mortems are published when relevant.
-
Where are servers located?
Primary region: EU (Frankfurt). Backup region: US East (Virginia). For customers with data residency requirements (healthcare, government), region-locked plans are available on request.