Trust & Security
Enterprise teams need to know exactly who touches their data and how it is protected. Here is our posture, kept honest and current. A machine-readable copy is at /security.json.
Data protection
All traffic is encrypted in transit (TLS 1.2+) and data is encrypted at rest by our database provider. Crawler IPs are stored only as keyed HMAC hashes, never raw. Secrets are held in a dedicated secret store and never committed or logged.
Tenant isolation
The platform is multi-tenant with row-level security (RLS) enforced on tenant-scoped tables; every request is bound to an authorized tenant. Report snapshots are shareable only by unguessable token and contain aggregate metrics only.
Access & SSO
Single sign-on (SAML / OIDC) with SCIM provisioning is available on the Scale tier. Role-based access (owner / admin / viewer) scopes what each member can do, and organization activity is captured in an audit log.
Compliance & governance
We operate a GDPR-aligned program with a Data Processing Agreement (DPA) and Standard Contractual Clauses available on request, and we are pursuing SOC 2 Type II (a Type I report is available to customers under NDA). EU data residency is available as an add-on on the Scale tier.
Reliability
The platform targets a 99.9% monthly uptime SLA on Enterprise agreements, with status published at /status and priority support.
Responsible disclosure
Report a vulnerability to security@omniforce.run. We acknowledge within two business days and will not pursue action against good-faith research.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Neon | Managed PostgreSQL (primary datastore) | EU / US |
| Coolify (self-hosted) | Application hosting & deploys (our infrastructure) | EU |
| Cloudflare | Edge delivery, WAF and DDoS protection | Global |
| Polar | Merchant of Record — payments & tax | EU |
| Resend | Transactional email delivery | US |
| OpenAI / Anthropic / Google / OpenRouter | Answer-engine probing (no customer data used for training) | US / EU |
Need our DPA, SOC 2 report, or a security questionnaire completed? Contact security@omniforce.run.