First, a genuine thank-you for Omi — the bet that the moat is personal context, not raw intelligence, is the right one, and building it in the open is what makes it worth trusting. We're all-in on that vision, and this issue is us trying to help the manifesto's own promise land harder.
The manifesto is unambiguous: "By collecting ALL data about the user… we commit to privacy and open-source," and "we use open source as a trust wedge." That wedge only holds if the person — or the company — whose entire context is being collected can keep that data on infrastructure they control. For an enterprise, "trust us, it's in our cloud" is a non-starter; the honest expression of a privacy-first promise is: run it yourself, no data leaves your walls.
Today the backend hard-depends on Google Cloud — Firestore across ~50 backend/database/*.py modules, plus Firebase Auth, GCS, Pinecone, and Cloud Tasks — with no supported way to stand it up without the cloud. So a security-conscious org literally cannot adopt Omi while honoring the manifesto's own privacy commitment.
Goal: make the backend runnable entirely on-prem, with each cloud touchpoint behind a swappable abstraction (neutral port + interchangeable implementations), so an organization can keep 100% of the personal context on its own infrastructure — while keeping the existing cloud backends first-class for everyone who wants them. Privacy-first as an architectural guarantee, not a pinky-promise.
✅ Done — the datastore (this is the first and biggest one)
The storage layer is delivered: the backend boots and serves offline with zero cloud egress, and every persistence call now goes through a neutral storage port with interchangeable Firestore and MongoDB implementations, selected by config. See the accompanying PR #10887 for the full change and its verification.
🔜 Next milestones — the rest of the road to zero cloud
Same pattern each time (neutral port → a real second implementation → contract tests for parity → cloud stays first-class):
Auth (OIDC) — Firebase Auth → also a self-hosted OIDC provider (e.g. Keycloak). Tokens verified locally; bring your own IdP.
Vector store — Pinecone → also self-hostable (e.g. Qdrant). Embeddings and recall stay on your infrastructure.
Object storage (S3) — GCS → also any S3-compatible on-prem store (e.g. SeaweedFS / RustFS). Raw recordings never touch a public bucket.
Land those three and the loop is closed: identity, structured data, vectors, and blobs all run on-prem. The only genuinely cloud-bound feature left is push notifications — fine behind a feature flag.
First, a genuine thank-you for Omi — the bet that the moat is personal context, not raw intelligence, is the right one, and building it in the open is what makes it worth trusting. We're all-in on that vision, and this issue is us trying to help the manifesto's own promise land harder.
The manifesto is unambiguous: "By collecting ALL data about the user… we commit to privacy and open-source," and "we use open source as a trust wedge." That wedge only holds if the person — or the company — whose entire context is being collected can keep that data on infrastructure they control. For an enterprise, "trust us, it's in our cloud" is a non-starter; the honest expression of a privacy-first promise is: run it yourself, no data leaves your walls.
Today the backend hard-depends on Google Cloud — Firestore across ~50 backend/database/*.py modules, plus Firebase Auth, GCS, Pinecone, and Cloud Tasks — with no supported way to stand it up without the cloud. So a security-conscious org literally cannot adopt Omi while honoring the manifesto's own privacy commitment.
Goal: make the backend runnable entirely on-prem, with each cloud touchpoint behind a swappable abstraction (neutral port + interchangeable implementations), so an organization can keep 100% of the personal context on its own infrastructure — while keeping the existing cloud backends first-class for everyone who wants them. Privacy-first as an architectural guarantee, not a pinky-promise.
✅ Done — the datastore (this is the first and biggest one)
The storage layer is delivered: the backend boots and serves offline with zero cloud egress, and every persistence call now goes through a neutral storage port with interchangeable Firestore and MongoDB implementations, selected by config. See the accompanying PR #10887 for the full change and its verification.
🔜 Next milestones — the rest of the road to zero cloud
Same pattern each time (neutral port → a real second implementation → contract tests for parity → cloud stays first-class):
Auth (OIDC) — Firebase Auth → also a self-hosted OIDC provider (e.g. Keycloak). Tokens verified locally; bring your own IdP.
Vector store — Pinecone → also self-hostable (e.g. Qdrant). Embeddings and recall stay on your infrastructure.
Object storage (S3) — GCS → also any S3-compatible on-prem store (e.g. SeaweedFS / RustFS). Raw recordings never touch a public bucket.
Land those three and the loop is closed: identity, structured data, vectors, and blobs all run on-prem. The only genuinely cloud-bound feature left is push notifications — fine behind a feature flag.