Security at OMNIRIQ

01EncryptionActive

• In transit. Every connection is forced to HTTPS/TLS with HSTS (one-year max-age); plain HTTP is redirected automatically.
• At rest — your model keys. Customer-provided API keys (BYOK) are encrypted with AES-256 before reaching the database, and decrypted only in memory at call time.
• Passwords. Stored as bcrypt hashes only. Plaintext never touches disk.
• Server secrets. Configuration files are denied direct web access at the server layer — readable only by the application itself.

02Sandbox & isolationActive

• Per-tenant scoping. Every API call is authenticated and scoped to its owner; cross-tenant reads and writes are denied at the data layer, not merely hidden in the UI.
• Per-agent context. Each agent owns its endpoint, its memory namespace (OmniContext), and its credentials. One agent failing never grants access to another agent's context.
• Supervisor containment. OmniGuard can restart or kill-switch an anomalous agent without touching its neighbors.
• Honest note. Isolation is enforced at the application and data layer on hardened cloud infrastructure. We describe exactly what we do — nothing more.

03Audit logs & monitoringActive

• Append-only agent logs. Every deploy, heal, restart, and error is recorded with a timestamp and visible in your console.
• OmniGuard patrols. An independent watchdog checks every agent every five minutes and acts on failures automatically.
• Public status. Fleet uptime, guard heals, and incidents are published live at status.html — including our bad days.
• Login monitoring. Failed sign-ins are logged per IP; repeated failures trigger automatic temporary lockouts.

04Access control & anti-abuseActive

• Sessions & tokens. Console sessions plus per-user API tokens; administrative and supervisor endpoints require bearer credentials.
• Brute-force defense. Eight or more failed logins from one IP within fifteen minutes triggers an automatic lockout.
• Injection defense. Parameterized queries everywhere (SQL injection), output escaping in the console (XSS), strict character rules for agent slugs.
• Hardened responses. Security headers on every page: nosniff, frame guards, referrer policy, HSTS.

05PaymentsActive

• Card data never touches our servers. Checkout is hosted entirely by PayPal; we receive only subscription status via cryptographically signed webhooks.
• No card storage, ever. We store plan state — never payment instruments.

06Data ownership & privacyActive

• Your documents remain yours. Export or permanent deletion on request — one email and it is done.
• No selling, no training. Your content is never sold and never used to train models.
• Minimal footprint. We collect only what the product needs in order to run.

07RoadmapIn progress

• SSO & team roles for organization accounts.
• Customer-facing audit export (CSV / JSON of all account events).
• Third-party penetration test and SOC 2 Type I preparation.

08Responsible disclosure

Found a vulnerability? Email support@omniriq.com with the subject SECURITY. We acknowledge within 48 hours, fix promptly, and credit you if you wish. We do not pursue legal action against good-faith security research.