Your CBAM records need to survive an HMRC inspection. Oremly is built for that.
Every file checksummed, every action logged, every role enforced. Data hosted in the UK and EU. Open a bug bounty or request our DPA at any time.
02 · What we do
Nightly automated backups, restore tested before every release
The database is backed up every night automatically. Before every deployment, the restore process is verified against a staging environment to confirm backups are usable. Untested backups are not backups — we test every one before you rely on it.
SHA-256 checksums on every stored file, verified on retrieval
Every evidence file, supplier document, and import record uploaded to Oremly is hashed with SHA-256 at the point of upload. The checksum is stored alongside the file metadata in the append-only audit log. On every retrieval — whether through the UI, API, or export — the checksum is recomputed and verified against the stored value. Any mismatch is flagged immediately. This ensures that the evidence you present to HMRC is provably unchanged since the day it was uploaded.
Append-only audit log no user can edit or delete
Every action in Oremly — uploads, confirmations, role changes, exports, logins — is recorded in an append-only audit log. The log uses a hash-chain structure: each entry carries the hash of the previous entry, so any retroactive edit or deletion breaks the chain. No user, including the organisation owner and platform administrators, can edit or delete log entries. The log is available for export at any time and is your evidence trail for HMRC inspection.
Roles (owner, editor, viewer)
Organisations use three roles. The owner manages billing, roles, and invites, and can pause or export the organisation. Editors upload ledgers, manage supplier requests, confirm extracted data, and prepare returns. Viewers see dashboards, reports, and the audit log but cannot create or modify records. Roles are granular enough that a customs broker can be invited as a viewer into a client organisation without accessing the client's other accounts.
Two-step verification
Two-step verification (multi-factor authentication) is available on every account and enforced for owner accounts. It uses time-based one-time passwords (TOTP) via any standard authenticator app. Recovery codes are provided at setup. Once enabled, no sensitive operation — role change, export, organisation deletion — proceeds without a fresh TOTP confirmation.
Full export
Every organisation can export its complete data in one click: import records, supplier emissions data, evidence files with checksums, the full audit log, and return-ready summaries. The export is delivered as a structured archive (machine-readable JSON alongside human-readable summaries). There is no proprietary format or lock-in. You can cancel at any time and take everything with you.
Paused accounts never deleted
When a subscription is paused, the account and all its data are retained indefinitely. CBAM requires six years of records, including records that show you were below the threshold. Pausing preserves your compliance evidence. You can reactivate and export at any point. Only an explicit organisation deletion request, confirmed by the owner, removes data — and even then the audit log is retained for the statutory period.
03 · Where data is hosted
UK (London) region
Primary data storage and application servers are in the UK.
EU region fallback
Disaster recovery and failover infrastructure in the EU. No data leaves the UK or EEA.
Encryption at rest and in transit
AES-256 for all stored data. TLS 1.3 for all data in transit. No exceptions.
04 · Our subprocessors
We engage the following subprocessors to deliver the platform. Each is bound by a data processing agreement with terms at least as restrictive as our DPA with you.
| Provider | Service | Region |
|---|---|---|
| Cloudflare | R2 object storage — evidence files and documents | UK (London) / EU |
| Railway | Hosting and PostgreSQL database — application servers and primary database | UK (London) / EU |
| Resend | Transactional email — supplier requests, notifications | UK / EU |
| OpenAI | AI document extraction — emissions data from supplier files | EU (data processing addendum in place) |
| Stripe | Payment processing — subscription billing | UK / EU |
We notify customers at least 14 days before engaging any new subprocessor. You may object within 7 days.
05 · Report a security issue
Responsible disclosure
If you have discovered a security vulnerability in Oremly, please report it to security@oremly.com. We operate a responsible disclosure policy: we commit to acknowledging your report within 24 hours, triaging it within 72 hours, and keeping you informed of progress toward a fix.
We ask that you:
- ✓Give us a reasonable time to investigate and fix before disclosing publicly.
- ✓Avoid accessing, modifying, or deleting data you do not own.
- ✓Not use automated scanners or denial-of-service testing against the production platform.
We do not operate a public bug bounty programme at this time, but we will thank and acknowledge valid reporters with their consent.
06 · Data Processing Agreement
Our DPA is part of the Terms of Service
We enter into a Data Processing Agreement with every organisation. It covers processing details, subprocessor authorisation, data breach notification within 48 hours, and your audit rights. Review it at any time without signing up.