Security and data
What Onym stores, how keys and secrets are handled, and how to reach us.
What Onym stores
- Your configuration: domains, brands, competitors, prompts and settings.
- AI answers: the full text of every answer to your prompts, its citations and the brands it names. Answers to your own prompts are only shown to your workspace.
- Accounts: email addresses, names, roles and sign-in sessions.
Onym doesn't need access to your website, analytics or customer data. It reads only your public homepage, robots.txt and llms.txt.
Keys and secrets
- API keys are stored only as a SHA-256 hash and shown once when created. They can be revoked at any time.
- Read keys can't change anything. Write keys can only add prompts as suggestions.
- OAuth tokens for MCP connectors expire after an hour; refresh tokens rotate on every use and can be revoked in Settings.
- Webhook payloads are signed with HMAC-SHA256 and a per-endpoint secret, with a timestamp to prevent replays.
- Share links are stored hashed and can be revoked.
Signing in
No passwords: one-time email links that expire after 30 minutes, or Google and GitHub sign-in. Session cookies are signed, HttpOnly and SameSite=Lax.
Sub-processors
Onym asks AI providers your prompts: OpenAI, Google, Perplexity and Anthropic, plus DataForSEO to capture consumer-app answers. Only the prompt text is sent, never your account or contact details. Payments go through Stripe and email through Resend. Onym runs on Railway in the United States.
Deleting data
Changing plans never deletes data. To delete a workspace and everything in it, email hello@getonym.com from an owner's address.
Reporting a vulnerability
Email hello@getonym.com with details. Please give us a reasonable time to fix it before disclosing it.