Security at OneType
What we do to protect your data, in plain words.
Who we are
OneType is a product of Divhunt GmbH, Chamerstrasse 172, 6300 Zug, Switzerland (UID CHE-297.885.332). A Swiss company, with your data hosted in the EU. Questions about security or privacy: security@onetype.ai.Where your data lives
Our servers are in Nuremberg, Germany (Hetzner). Files, chat images and backups are stored on Cloudflare R2 under EU jurisdiction. AI answers are written by OpenAI or Anthropic (US); search uses Mistral (EU) and Voyage AI (US); email goes out through Resend and payments through Stripe. The full list is on our sub-processors page.Your own AI key
If you use your own AI key, that provider works under your own agreement with it.Encryption
All traffic is encrypted (HTTPS, with HSTS). Your AI keys, integration tokens and webhook secrets are encrypted with AES-256-GCM. Passwords are stored as strong hashes (scrypt), and API keys only as hashes.Each workspace kept apart
Each workspace's data is kept separate, and search results are checked so nothing from another workspace can come back. The database and search index accept connections only from the same server.Who has access
Server access is limited to authorised personnel with SSH keys. In the app, you decide who is owner, admin or member.Logs
App logs hide emails, phone numbers, IP addresses and secrets. Each workspace has an audit log you can see, kept for 365 days.Backups
Daily backups of the database and search index, stored in the EU, with a restore tested every week. Automated health checks run every few minutes.Abuse protection
Rate limits per visitor and per site, and the chat runs only on the domains you allow.Safe answers
Our crawler respects robots.txt and never reaches internal systems. Instructions hidden in web pages are ignored, and answers may only link to approved sites. We don't use your content to train AI models.Your data, your control
Erase a contact together with their conversations, or export everything about them. Export contacts and conversations. Delete your workspace (restorable for 30 days, then deleted) or your account (anonymised straight away). Conversations are kept until you delete them; a setting to delete them automatically after 30 to 730 days is coming to the app.Report a problem
Found a security issue? Write to security@onetype.ai
Questions, answered.
In the EU. The app, database and search index run on Hetzner servers in Nuremberg, Germany, and files and backups are stored on Cloudflare R2 in the EU. AI answers are written by OpenAI or Anthropic in the US.
The provider of the model your agent uses sees each question with the matching parts of your content, to write the answer: OpenAI or Anthropic, or the provider of your own AI key. Search also uses Mistral (EU) and Voyage AI (US).
No. OneType doesn't use your content or your visitors' chats to train AI models.
No. Every record belongs to one workspace, every query is limited to it, and search results are checked again so nothing from another workspace can come back.
No. The chat sets no cookies; it keeps the conversation in the browser tab's session storage, tied to your agent and your site.
Open the person in Contacts and choose Erase contact: it deletes their details and their conversations' content. You can also download everything about them as a file first. Only owners and admins can do this.
Until you delete them. A setting to delete them automatically after 30 to 730 days is coming to the app.
No, OneType has no SOC 2, ISO 27001 or other certification today. For security questions, write to security@onetype.ai.