Trust & Security

Security is foundational to Omniroq. This page summarizes the technical and organizational measures we use to protect your data. It supports our commitments under the Privacy Policy and DPA.

Data protection

• Encryption in transit. Traffic to the Services is encrypted using TLS.
• Encryption of secrets at rest. Sensitive credentials such as integration access/refresh tokens are encrypted at rest.
• Tenant isolation. Customer Data is scoped per account/team so that one customer cannot access another's data.

Access control

• Role-based access control (RBAC) and granular permissions within the product.
• Least privilege for internal administrative access, granted only as needed.
• Authentication options including strong passwords and, where configured, single sign-on (SSO).

Application security

• Protections against common web risks (e.g. CSRF tokens, session security, output escaping).
• Signed-webhook verification for supported integrations.
• Regular dependency and code review as part of our development process.

Infrastructure & availability

• Hosting with reputable cloud providers (see Sub-processors).
• Backups and recovery procedures for the application database.
• Monitoring and logging to detect and respond to issues.

Operational practices

• Confidentiality obligations for staff with access to data.
• Change management for production systems.
• An incident-response process, including breach notification consistent with our DPA and applicable law.

Your role in security

Security is a shared responsibility. We recommend you use strong, unique passwords, enable SSO where available, manage user access carefully, and promptly remove users who no longer need access.

Reporting a vulnerability

If you believe you've found a security vulnerability, please report it responsibly to [email protected]. We appreciate coordinated disclosure and will work with you to validate and address legitimate reports.