Security
Last updated 30 October 2026
What you put into Chomi is often the most specific thing a business knows about itself, and the interviews are recordings of real people. This page sets out how that is handled. The privacy policy is the formal version of the same commitments.
Payments never touch this site
Every subscription and top-up is paid through PayPal’s own checkout. PayPal takes the payment and holds the card details, which never reach us. We see that a payment succeeded, what it was for, and the email on the account. We never see the card.
Where your data lives
Your workspace, its briefs, interviews and content are stored with Supabase, which provides the database, sign-in and file storage, and the app is hosted on Vercel. The domain’s DNS runs on Cloudflare. Data is encrypted at rest by Supabase, and every connection, to the app and to the database behind it, is encrypted in transit.
One workspace cannot read another
Which workspace a signed-in person may read is decided by access rules in the database itself, not only by what the app chooses to show. An agency’s clients, and different businesses using Chomi, are kept apart at that level.
Your account
- Passwords are handled by Supabase’s sign-in service and stored hashed. We never see them.
- Changing the email on an account asks for the password first.
- Sign-up and sign-in are protected by Cloudflare Turnstile, a check against automated bots.
Review links
Clients can review a brief or a finished piece through a link, without an account. Each link opens only the one piece it was made for, with the permission it was given: to read it, comment on it, approve it or edit it.
Interviews and AI
Interviews are recorded so they can be transcribed and written up. OpenAI converts the audio to text, and the writing itself is done by AI models from Anthropic, OpenAI and Google, reached through OpenRouter. Each provider may use your material only to provide that service to us. We do not use your content to train AI models, and we do not sell your information.
If you send an interview link to somebody else, tell them they are being recorded before they start.
How long anything is kept
- While your account is open, your content is kept so the service works.
- When you delete your account, your workspace content is deleted within 30 days.
- Backups roll off on their own schedule, within 90 days.
- Billing and tax records are kept for five years, as tax law requires.
Reporting a problem
If you think you have found a security problem, write to hello@chomi.io. A real person reads it, and we will tell you what we did about it.