Security
Your orders are your business. We guard them like our own.
Osnovia runs on the same principles as the system that has handled our own sales for years. Below, in plain words, what happens to your data.
Eight things we do with your data
- 1
Servers in Finland, in the European Union
Data physically sits in a Hetzner data centre in Finland, a country with some of the highest infrastructure protection standards in Europe. It does not leave the EU. The only exception is the AI assistant, and only if you switch it on.
- 2
Encrypted in transit and at rest
The connection from your browser is encrypted, server disks are encrypted, backups are encrypted with a key that is not kept on the server.
- 3
Each company sees only its own data
Isolation is enforced by the database itself, not only by the application. Even a bug in the code will not show you someone else’s orders.
- 4
Admin access only through a private network
Servers have no open login from the internet. We enter through an encrypted private network, without a root account, and every login is recorded.
- 5
Backups that actually work
A backup every 24 hours, stored away from the production server. Once a month we restore it as a drill, because an untested backup does not exist.
- 6
Two-factor login and an event log
Every account can be protected with a second factor. You see who changed an order, an invoice or a setting, and when.
- 7
Monitoring around the clock, patches within 24 hours
Automated checks watch the servers and alert us immediately. Security fixes are applied within a day of release.
- 8
Audit before launch and external testing
Before opening to customers we run our own audit, then commission penetration tests from an outside firm. Results will be described here.
What we do and what depends on you
| Area | Osnovia | You |
|---|---|---|
| Servers and backups | maintenance, patches, backups, restore drills | nothing |
| Login | hashed passwords, second factor, lockout after failed attempts | enable the second factor; one account per person |
| Marketplace and carrier credentials | encrypted in the database, never shown again after saving | you grant access in the marketplace panel and can revoke it any time |
| Team permissions | roles: admin, manager, packer, customer service; access per channel | you decide who sees invoices and margins |
| Export and deletion | full export any time, deletion on request within 30 days | one request |
Who can access your data
Day to day, nobody but you and your team. Our administrators open a customer’s data only at the customer’s request, when solving a reported problem, and every such access is logged. There are three subprocessors: Hetzner Online GmbH (servers in Finland), home.pl sp. z o.o. (e-mail, which we use to talk to you about support requests) and, only if you switch on the AI assistant, Anthropic, the provider of Claude models in the United States. Anthropic receives only the conversation with your customer and the order data needed to answer, deletes it within 30 days and does not train models on it. Without the assistant, no data leaves the European Union.
When something goes wrong
Server failure: we restore from backup, targeting under 8 hours of downtime and under 24 hours of lost changes. A security incident involving your data: we inform you by e-mail within 24 hours of detection, with what happened and what we did, as the GDPR requires. A status page with planned maintenance goes live before the beta opens.
Why Finland
The data centre operates in the EU under EU data protection law, in a country with stable power, a cool climate and some of the highest infrastructure security standards in Europe. We also keep our own production systems there, so Osnovia sits next to the things our own company depends on.
Your data is yours
At any time you download a full export of orders, products, customers and invoices. When you leave, we delete your data on request within 30 days. We do not sell it, do not analyse it for ads, do not share it with anyone beyond legal requirements.
A GDPR data processing agreement is signed with every company when the account is created. Security questions and vulnerability reports: security@osnovia.com (see also security.txt).
Early access
Sign up before the beta opens
First companies join in winter 2026/27. We help move your data and set everything up with you. No fees, now or later.