Privacy Policy, GDPR & Data Isolation

Last Updated: November 2026 · Data Controller: OMNIAMUS S.R.L., Str. Cibinului Nr. 4, Ploiesti, Prahova, 100377, Romania (CUI 54719073, email [email protected]).

Oxyo is engineered from the ground up around strict tenant isolation, minimal data collection, and compliance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).

1. Strict Multi-Tenant Vault Isolation

Each registered account operates inside a dedicated per-tenant storage vault. Your conversation threads, contradiction-free beliefs, causal graph edges, uploaded document extracts, and custom skills are strictly isolated to your authenticated account and are never visible to other tenants.

2. Zero Training on Private Prompts or Proprietary Code

OMNIAMUS S.R.L. does not sell user data, embeds zero third-party ad trackers, and never trains public models on your private prompts, proprietary repositories, financial statements, or personally identifiable information.

3. Cryptographic Credential Protection & Isolated Execution

• Account passwords are protected with salted PBKDF2-HMAC-SHA256 hashing; API keys (oxy_live_...) are stored exclusively as one-way cryptographic hashes.
• Optional Bring-Your-Own-Key (BYOK) provider keys are encrypted at rest and restricted to official HTTPS upstream endpoints.
• Deterministic Python code verification executes inside an isolated, zero-network sandbox with strict AST guards and execution timeouts.

4. Your GDPR Rights

You may inspect your vault state (GET /api/v1/state), delete individual threads, revoke API keys, clear BYOK credentials immediately from the Oxyo Console, or request complete data export or account erasure by emailing [email protected].