your stuff, kept safe
How we keep your data safe.
OScar holds the things that matter: your notes, documents, photos, passwords and plans. Here's how your account is protected, where your data lives, and how the backups work, in plain words.
Getting into your account
Only you, and only with what you know and what you have.
- Two-step sign-in
Add an authenticator app and every sign-in asks for a six-digit code as well as your password. A stolen password alone gets nobody in.
- A lock on the app
Lock the desk with a PIN, Face ID or your fingerprint, and give any project a PIN of its own. It locks itself again when you step away.
- Your devices, in view
See every device that's signed in to your account and sign the others out with one click. Changing your password signs them out too.
- Bots stay outside
Sign-in has a check that you're a person, and repeated wrong guesses are slowed down and then stopped.
the Vault
Locked with a key only you hold.
Your passwords and secrets in the Vault are encrypted in your own browser, with a passphrase that never leaves your device. We store only the scrambled result, so not even we can read it: the only key is the one you hold.
The honest flip side: if you forget the passphrase, nobody can open the Vault for you, us included. Keep it somewhere safe.
no passphrase, no peeking
no funny business
Your data stays yours.
yours only
Locked to you, in the database itself
Every note, file and list is tied to its owner where it's stored, not just in the app on top: the database itself checks who's asking before it hands anything over.
never public
Private files, short-lived links
Your files are never public. When you open one, you get a private link that stops working soon after: a copied link can't be passed around.
you decide
Sharing that ends
A share link always has an end date, asks for a password or the visitor's email first, and stops working the moment you revoke it. Shared links live on their own address, viaoscar.com.
scrambled
Encrypted on the way and at rest
Everything travels over an encrypted connection, and the services that store your data keep it encrypted on their disks. Passwords and PINs are stored as one-way hashes, never as themselves.
- we never sell your data
- no ads, ever
- no AI trained on your stuff
The details are in our privacy policy.
just in case
Backups, tested every day.
Things go wrong: a slip of the finger, a broken disk, a bad day at a data centre. So your data is copied, encrypted, to a second company in Europe, and every copy is checked.
Twice a day
A full copy of the database
Everything you've written, planned and saved is copied. It's encrypted before it leaves, and only a key that never touches our servers can open it.
Every time
We prove the copy works
Each new copy is restored into a fresh test database and counted against the real one. A backup nobody has restored is only a hope, so we restore every single one.
Every night
All your files
Documents, photos, videos, Vault files and pictures in your drawings are copied too, encrypted, names and all.
For 30 days
Locked so nobody can touch them
The copies live with a separate company, and they're locked: no one can change or delete them until the lock runs out. Not us, and not anyone who got hold of our keys.
Every month
One more copy, offline
A copy also goes onto a drive that's unplugged and kept away from the internet, out of reach of anything that happens online.
Deleted by mistake?
Deleted files wait in Recently deleted for 30 days, so you can put them back yourself.
Nothing vanishes quietly
Going over your storage never deletes anything on its own: you'll hear from us, more than once, long before anything happens.
where it lives
In Europe.
Your account and files are stored in Switzerland and the EU, the servers that run OScar are in Germany, and the backups are kept in the EU too. The full list of who does what is in the privacy policy.
always watching
Checked every night.
Automatic checks run against the live site every night to make sure the locks are still locked. The software OScar is built on is scanned for known problems on every change, unusual activity raises an alarm, and an outside scan looks at the site every month.
Your part (it's small)
- Turn on two-step sign-in under Security.
- Use a password you don't use anywhere else.
- Keep your Vault passphrase somewhere safe.
- Export a copy of everything whenever you like.
Found something that looks wrong?
If you think you've found a security problem, please tell us first and privately at contact@riennetwork.com. We read every message and fix what's real, fast.