Customer trust is non-negotiable. Below is an honest snapshot of the security, privacy, and compliance controls protecting your data — what's in place today, what we're shipping next, and what's on the roadmap.
SOC 2 Type I — targeting Q3 2026
We're actively preparing for SOC 2 Type I certification, with Type II observation beginning immediately after. This page reflects our progress in real time. If you need a specific control evidence pack ahead of an enterprise procurement review, email security@omniagency.app.
Bcrypt password hashing
All passwords hashed with bcrypt at rest. Plaintext never stored or logged.
JWT-based session tokens
Signed JWTs with expiry. No PII in the token payload.
Role-based access control (RBAC)
Four-tier RBAC (superadmin, owner, admin, agent, staff) plus per-role feature gating.
Multi-tenant data isolation
Every database query is organization-scoped. Cross-tenant access is impossible at the data layer.
Two-factor authentication (TOTP)
Roll-out underway. Required for all enterprise tier accounts.
SAML / OIDC single sign-on
Available on the Enterprise tier. Engineering Q3 2026.
Idle-session timeout & re-auth on sensitive ops
JWT TTL enforced today; idle-window timeout shipping with the 2FA release.
TLS 1.2+ in transit
All traffic encrypted via TLS. HTTPS-only with HSTS.
Encryption at rest
Database encrypted at rest by the managed provider.
Secrets management
API keys & DB credentials in environment variables only — never in code, never in logs.
PCI scope minimisation
Card data never touches our servers. All payments via Stripe Checkout (PCI DSS Level 1).
Customer data export (GDPR/CCPA)
Self-serve export endpoint shipping with the next compliance release.
Customer data deletion
Self-serve org deletion with 30-day soft-delete shipping with the next compliance release.
Application audit log
Every create/update/delete is logged with actor, timestamp, IP, entity, before/after diff.
Admin action audit log
All superadmin and platform-level admin actions logged separately and immutably.
Customer-facing audit log export
Per-org audit log download for customers to prove their own compliance.
Production access logging
All operator access to production databases and servers logged via the platform.
Failed-login lockout
Sliding-window lockout after repeated failed login attempts.
Input validation & schema enforcement
Pydantic schemas validate every API input. Mongo $where / NoSQL injection blocked at framework level.
Output sanitisation (XSS prevention)
React auto-escapes by default; user-rendered content sanitised.
CSRF protection
Bearer-token auth (no cookies) makes CSRF non-applicable to API surface.
Rate limiting on auth endpoints
Login, password-reset, and signup endpoints rate-limited per IP.
Dependency vulnerability scanning
Snyk/Dependabot scans on every PR.
Annual third-party penetration test
Scheduled for Q3 2026 ahead of SOC 2 Type II audit.
Daily encrypted backups
Database snapshots taken daily and retained for 30 days, encrypted at rest.
Documented disaster recovery plan
Drafting alongside SOC 2 prep. Quarterly tabletop tests once finalised.
Change management via Git PR review
No code reaches production without PR review and CI checks.
Uptime monitoring & alerting
Health-check endpoint + uptime monitor pinging every 60 seconds.
Privacy Policy (published)View →
Public, versioned, GDPR/CCPA-aware.
Terms of Service (published)View →
Public, versioned, includes acceptable-use clauses.
SMS consent disclosure (TCPA/CTIA)View →
Public opt-in proof page for telecom compliance.
Data Processing Agreement (DPA)
Customer-signable DPA for GDPR controllers — available on request today, self-serve soon.
SOC 2 Type I report
Targeting Q3 2026.
SOC 2 Type II report
Targeting Q1 2027 following the Type II observation period.
Information Security Policy
Drafted; under final review.
Incident Response Plan
Drafted; first tabletop exercise scheduled.
Background checks for new hires
Required prior to first SOC 2 audit. Vendor: Checkr.
Annual security awareness training
Required prior to first SOC 2 audit.
Confidentiality agreements
All team members sign mutual NDAs before access provisioning.
Quarterly access reviews
Formalising the quarterly cadence and evidence collection.
This page is a human-friendly summary. The documents below are the legally authoritative versions used in procurement and enterprise security review.
Master Service Agreement
Umbrella legal agreement — scope, licensing, IP, liability, support.
Request via legal@omniagency.appData Processing Agreement
Controller/processor roles, security, sub-processors (Annex A), breach notification.
Request via privacy@omniagency.appSecurity Whitepaper
Infrastructure, encryption, access controls, audit logging, backup & DR.
Request via security@omniagency.appAI Usage Policy
AI providers, no-training commitment, retention, output ownership, opt-out.
Request via privacy@omniagency.appThird-party services that may process customer data on our behalf. Each is bound by a Data Processing Agreement and is reviewed annually.
| Vendor | Purpose | Data accessed | Region |
|---|---|---|---|
| Stripe | Payment processing | Billing email, last-4, card-token only | US, Global |
| SendGrid | Transactional email delivery | Recipient email, message body | US |
| Twilio | SMS notifications | Phone number, message body | US, Global |
| Zoom | Video meetings | Host/attendee name, email, meeting metadata | US |
| Nylas | Calendar & email sync | Calendar events, OAuth tokens | US |
| OpenAI / Anthropic / Google | AI-assisted features (via Emergent LLM Key gateway) | Prompt content; never used for training | US |
| MongoDB Atlas | Primary application database | All customer data | US (encrypted at rest) |
| Emergent | Hosting platform | Application runtime, logs | US |
Email security@omniagency.app — we triage within one business day and acknowledge within 24 hours. Coordinated disclosure is welcome.
Yes. Email security@omniagency.app and we'll send our standard Data Processing Agreement, signable digitally.
Primary storage in the United States. We will offer EU-region storage as part of the Enterprise tier in a future release.
No. AI features route through providers under enterprise contracts that explicitly prohibit using prompts or completions for model training.
Active data is retained for 30 days post-cancellation in case you reactivate, then permanently deleted within 90 days. Backups are purged within 180 days. Earlier deletion available on request.
Email security@omniagency.app and we'll respond within one business day.