Trust Center
This page only describes what we have built and tested. It is updated when the implementation changes.
Where data is stored
OmaTutka content (radars, cards, contracts, dates, workspaces) is stored in a Cloudflare D1 database restricted to the EU jurisdiction. Tutkat account data is stored in an EU-restricted database. Traffic is TLS-encrypted; requests may be received at the nearest Cloudflare data centre, including outside the EU, so we do not claim that all processing happens in the EU.
Permissions are checked on the server
Every request is checked on the server by role, person, object and field. The interface, a theme or a view cannot open data you have no right to.
A direct link or ID does not bypass permissions
A hidden contract or radar will not open even if its ID is known. Tested for child profiles, team members and outsiders, among others.
Revoking access is immediate
When a member is removed or a child's allowed radar is removed, access ends from the next request.
Field-level restrictions
On Business you can hide e.g. price and attachment from certain roles – also in list views and data exports.
Audit trail
On Business, changes are logged. Only owners and admins can see the log.
Ads are never disguised
Commercial content is always labelled "Ad". Commercial content can never be an Alert. A provider on your Blocklist never returns to commercial suggestions or to offers imported from specialist radars.
Data export and disconnect
You can export your own data as JSON. When you disconnect a specialist radar, the data imported from it is deleted from OmaTutka.
Payments
Payments are processed by Stripe. OmaTutka does not store card or bank details.
Sign-in
The same Tutkat account as in the other Tutkat services. Only a salted hash of passwords is stored.
Testing
Moving storage, backups and restore have been tested. Permissions, the Blocklist and payment entitlements have automated tests (incl. cross-user, cross-workspace, direct ID, export, attachment fields and revoked access). Payments are tested in Stripe's test environment.
In progress before general availability
- Opening the app: end-to-end tests as a signed-in user.
- Storing attachments in EU-jurisdiction storage before attachments are enabled.
Found a security issue? Let us know: [email protected]
Updated 5.11.2026