What you can check before you trust us.

Where your files live, what we back up, what we can read, and what we have not done yet. Plain facts, with a date; nothing here is a certificate.

Where files live

Storage

DigitalOcean Spaces in Singapore (SGP1). Served over TLS; encrypted at rest by DigitalOcean.

Backups

Every night, the database and every new file are copied to a separate, versioned backup store that the production key cannot reach. Same provider, second bucket; a second provider is planned.

Restore drills

Every week a drill restores the latest backup into a separate database, checks it against the backup’s record, and reads files back to check them against their recorded hashes.

Health

A health check every five minutes.

What we can read, and what we do with it

Encryption

In transit and at rest. Not end-to-end: your AI has to read the files, so we can too. We say this plainly instead of pretending otherwise.

Training, ads, trackers

We never train AI models on your files and never sell them. No ads. This site sets no cookies and runs no scripts.

Who changed what

Every change is recorded with who made it, which AI and why; versions can be compared, restored and undone. A year of history on every plan.

Your account

Sign-in

With your Google account or a one-time code sent to your e-mail. The AIs and keys you connect are listed in the app and can be disconnected or revoked at any time.

Limits

Rate limits on every connection, key and network address. Sign-up is by invitation during early access.

Leaving

Export everything you can open as a zip, any time. Deleting your account holds it for 30 days. Trash keeps files 30 days.

Tests

More than 2,700 automated isolation tests check that no account, member, AI connection or private folder reaches what it may not.

Reporting a problem

Write to support@olifant.io with “Security” in the subject. We answer every email within 12 hours.

Last checked against our code and deployment on Nov 1, 2026.