The Omni Group

Thanks to everyone for the kind words - we’re really grateful!

Kevin B, if your existing sync setup is working well for you, sticking with it as a completely reasonable move. Main advantage to someone in your position would be a greater ability on our part to help if something unexpected ever happens to your files or data. Of course, the privacy/security implications of sharing your data with any third party solution also need to be considered.

The main advantages of our service accrue to folks still syncing via iDisk/MobileMe (going away in June) or who are paying for third-party WebDAV hosting in order to sync their data and would prefer a no-cost/no-subscription option to do so…

Kevin: If you’re already paying for the DreamHost account for other reasons, then you wouldn’t save any money with our service. If your data’s on the Omni Sync Server and something goes wrong, you could simply ask us to take a peek and see what’s gone wrong, rather than figuring out how to send us a copy of your database. Performance times might be better or worse, depending on your geographic distance from our servers in Seattle.

Excellent question, Michael. It wouldn’t be responsible to issue a blanket guarantee of security, but we have worked hard to secure the servers and keep your data as safe as our own is. However, the files aren’t stored in encrypted form on the servers.

We’re interested in doing that eventually, but there are other changes that customers have been asking for more frequently; that’s why the encryption work hasn’t made it to the top of our to-do list yet. If it helps, access to those drives is restricted to our admin-level IT staff, or people from other departments if they use a tool that will automatically email you if they access your information. Accessing a customers’ data without prior permission from them to do so is a fireable offense.

The server is protected by all the same security measures that protect our online store. Communication in both directions is encrypted via HTTPS. (That’s the same technology that most banks use for their online banking systems.) We’re regularly audited by a third party that looks for security vulnerabilities. Your files are just as protected as our financial information and the source code for our products, in other words.

We do gather some information about the files in your account - “X customers have OmniFocus databases in their account”, for example - but respecting your privacy with respect to the *content* of those files is a top priority.

If you want maximum privacy for your files, a server you run yourself is going to be a better choice than any server run by a third party, whether it’s ours, iCloud, Dropbox or any other. Since you run your own server, I suspect you already know that, though. :-)

Hope that helps!

Jax,

OmniFocus and DropBox have made different design decisions about how to handle data and data conflicts, so they really aren’t compatible. Several customers have lost data syncing OmniFocus via DropBox. You can find more details about this on our forums, including this thread:  http://forums.omnigroup.com/showthread.php?t=13130

VO: I work for Omni, unlike Bill, so it would probably be more appropriate to address those questions to me. (Bill is another Omni customer, like you.)

I should note that we do plan to offer things which are more interesting than simply storing your files: for example, we’d like to provide a web API for accessing your OmniFocus database from anywhere.

But that said, client-side encryption is exactly how I’d like to solve this privacy issue. Before we can implement that, though, we have to make sure that our apps would qualify as a “mass market encryption item” under the export classification ruling issued by the United States Commerce Department. (Or, if we’re unable to get that designation for some reason, I guess we’ll need to register each of our apps so that we have an Encryption Registration Number.) We’re working on this process right now.

Once we know we can actually legally ship client-side encryption, then we’ll still have to figure out the design questions. I’m not the local expert, but for OmniFocus, for example, it might be nice to use asymmetric encryption so you could send email to the cloud and have it land, encrypted via your public key, in your OmniFocus database. We’ll need to figure out how to handle key management: in particular, we need to figure out how best to transfer your key between devices to allow syncing between them in the first place, and whether we want to try to offer some sort of key registration/recovery (and if so, what system we use to keep those keys secure from anyone but you—simple client-side pass-phrase encryption?).

I’d welcome any thoughts you (or anyone else) might have about how we should design encryption into our apps; please feel free to email me directly at .(JavaScript must be enabled to view this email address).

(But all that said, I should note that our first priority right now is to automate syncing of our document-based apps, so you don’t have to manually import and export files from the cloud each time you want to use them.)