Omitly security
Omitly's value proposition is a security claim: your documents are redacted locally, the removal is independently verified, and nothing is uploaded. A claim like that should be falsifiable — so we publish the evidence.
Posture at a glance
Documents never leave your device, and Omitly makes no automatic network connection. It goes online only when you ask it to: checking for and downloading updates, sending the support form, or RFC 3161 timestamping, which sends only a hash and never content. Timestamping is off by default and is an opt-in. The threat model lists every network path.
Underlying text and image data is removed, then independently re-checked on the output. Default-deny: any uncovered path fails the check.
Our threat model is public. Security by transparency, not obscurity.
What's here
- Threat model — what we're protecting, what can go wrong, and what we do about it.
- Cryptography — every cryptographic primitive in the product, its purpose, and its FIPS posture (our CBOM).
- Releases — a signed security attestation per release: artifact hashes, an OWASP ASVS coverage scorecard, and the evidence behind it.
- Keys — our signing keys and fingerprints, so you can verify attestations yourself.
- Third-party notices — the licences of everything we depend on.
- Disclosure — how to report a vulnerability.
Customers
Current customers can access the full evidence set — complete SBOM and CBOM documents, raw test output, the full ASVS workbook, and pen-test reports — by proving a valid licence. Access is itself gated by the same licence cryptography documented on this site.
Latest release attestation
No signed release attestation has been published yet. This section will show the latest one once the release pipeline publishes it.
Vendor root key
All Omitly attestations chain to this root. Confirm it matches the fingerprint in the app under About:
cb0c32a965f7c0d2365d795f2a81c73e728f09a332b73af200364f7b2bc3a429