SOC 2 and ISO 27001 certifications evaluate organizations that host, process, and manage customer data on remote cloud servers. Because Oyma operates zero cloud infrastructure and never hosts customer data, SOC 2 reports do not apply.
What SOC 2 and ISO 27001 Actually Measure
System and Organization Controls (SOC 2) Type II and ISO/IEC 27001 are auditing standards designed specifically for service organizations that operate cloud multi-tenant infrastructure. These audits assess whether a vendor enforces rigorous controls around:
- Cloud data center physical security (e.g., AWS or GCP server access)
- Multi-tenant database segmentation and data leakage risks
- Employee access controls to customer production databases
- Cloud backup disaster recovery and incident response protocols
When you use a cloud note app or cloud meeting bot, SOC 2 is vital because their employees and servers hold your confidential files.
Why Local Desktop Software Operates Differently
Oyma is not a Software-as-a-Service (SaaS) cloud vendor. It is a local desktop application that executes entirely on your macOS hardware.
- Zero Cloud Servers: We operate no central database servers, cloud processing pipelines, or remote customer file storage.
- Zero Access to Customer Notes: Oyma employees have zero technical ability to access, view, or decrypt your notes or recordings.
- Simplified Vendor Security Reviews: For corporate InfoSec teams, local-first software is evaluated as an installed desktop utility (similar to Git, Vim, or Visual Studio Code) rather than a high-risk cloud data processor.
| Security Review Aspect | Cloud SaaS Note Tools | Oyma Local Software |
|---|---|---|
| Vendor Database Access | Vendor engineers can access DB | Zero vendor access possible |
| Cloud Breach Exposure | High (shared multi-tenant cloud) | Zero (no cloud servers exist) |
| SOC 2 Type II Report | Required to verify cloud controls | Not applicable (no cloud infra) |
| Data Custody | Vendor retains data custody | You retain 100% data custody |
Enterprise procurement teams can clear Oyma rapidly through binary code-signing verification, sandboxing audits, and egress network inspection without lengthy SaaS vendor risk assessments.
Evaluating Local Software in Enterprise Security Reviews
Why local desktop utilities differ from cloud SaaS platforms:
- No Multi-Tenant Cloud Infrastructure: SOC 2 reports assess cloud database security and vendor employee access controls; Oyma operates no cloud databases.
- Installed Utility Review: InfoSec teams evaluate Oyma as an installed client utility (like Git or VS Code) rather than a cloud data processor.
- Apple Developer ID Signing: Cryptographically signed binaries and Apple Hardened Runtime guarantee binary integrity.
- Frictionless Procurement: Eliminating cloud data residency risks accelerates enterprise procurement approvals.
Simplified InfoSec Reviews for Installed Utilities
Because Oyma operates zero cloud infrastructure and stores no customer data on remote servers, enterprise security teams evaluate it as an installed local utility, bypassing complex SaaS vendor risk audits.
This drastically reduces enterprise procurement timelines from several months of security questionnaires down to a simple binary integrity and code-signing check.
