Skip to content

Security & Trust

What's actually true today.

We're a young company. Rather than a padded compliance-checklist page, here's a plain account of how your data and payments are actually handled by this site right now — and what we're working toward.

Data handling

The pages you're reading are static files. Behind them we run one small backend — a single Cloudflare Worker — and it does store data. Here is everything it holds and everywhere else your information goes.

  • Forms — stored by us. Every form on this site posts to our own Worker, which writes one row to a database we run on Cloudflare. That row holds the name, email address and message you typed, the country Cloudflare reports for your connection, which form it was, and when. Nothing else.
  • Orders — stored by us. When a payment succeeds, the same Worker writes a row holding the email address you used at checkout, what you ordered, the amount, and Stripe's identifiers for your customer and subscription records. Not your card details — those never touch our infrastructure. See Payment security below.
  • Analytics. We use Plausible, a cookieless analytics tool that doesn't track you across sites or build an individual profile of you. It records aggregate events (a page view, a calculator interaction, a form submit) — nothing that identifies you personally.
  • What we can't see. None of this gives us access to the contents of a server you rent from us. Your files, your databases and your applications are yours; we hold the billing and enquiry records described above, and that is the whole list.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it, through the contact page. Our Privacy Policy is the longer version of this section and the two are kept in step deliberately.

Payment security

VPS tier checkout runs through Stripe. When you check out (via Stripe Checkout, opened from the configurator), you enter your card details directly on Stripe's own hosted checkout page — not on an Olympia-controlled page or server.

Olympia never sees, receives, or stores your full card number, CVC, or other card data at any point. Stripe is a payment processor used by a large share of the internet's checkout flows and handles that data under its own PCI-compliant infrastructure — we're relying on Stripe's security, not building our own.

Infrastructure

Olympia's VPS and dedicated-server tiers are priced against Hetzner-equivalent specs (see our comparison page) — the underlying hardware is comparable to what a well-run European VPS provider offers, not a proprietary in-house data center.

We do not currently hold any third-party compliance certification — no SOC 2, no ISO 27001, no completed penetration test. We're not going to claim one we don't have. If and when we pursue one, we'll say so here with a real date and a real report, not before.

What we're working toward

  • Automated infrastructure monitoring and a live status page. We provision servers today, but we don't monitor them automatically yet — Status says exactly what that means.
  • A documented incident-response process, published here once it's written down rather than described from memory.
  • Third-party security review, once the business is at a stage where that's a meaningful investment rather than a checkbox.

We'd rather tell you honestly where we are than dress up a young company with enterprise security theater.

Report a security concern

Found a vulnerability, a data-exposure issue, or anything else security-related? We want to hear about it directly, before it goes anywhere else. Email security@olympia.so with details, and we'll respond as quickly as we can. We don't yet have a formal bug-bounty program or a published PGP key — if that changes, this page will say so.