I remember there was an article about how OmniFocus Web works with regards security:
https://inside.omnifocus.com/blog/security-and-encryption-in-omnifocus-for-the-web
TLDR: if you use OmniFocus Web your data is stored unencrypted (for a “while”) on Omnis app servers for performance reasons.
I think they still support WebDav sync to your own server, this page refers to OmniFocus V3:
https://support.omnigroup.com/documentation/omnifocus/mac/3.0/en/getting-synced/
