Security

Each company gets its own environment: no shared databases, no shared infrastructure. It runs on AWS by default, or on Azure or Google Cloud where required.

Data is encrypted in transit and at rest, with encryption keys you control. Where a company needs it, Omnisce runs inside the company's own cloud account instead, operated by us.

People sign in through your identity provider, and their roles follow your directory.

What anyone can see follows your permissions and clearance levels, and compartments enforce information barriers. Where someone isn't cleared, Omnisce withholds the material, and acknowledges it exists only if your policy allows.

Agents are held to a stricter standard than people.

A compartment can be closed to automated access while the people inside it keep theirs, and an agent whose next step conflicts with the record is stopped before it acts.

Omnisce works with the models you choose, including open-weight models run inside your environment, so sensitive material never reaches an outside AI provider.

Where you choose outside models, they're used under terms that prohibit training on your data.

Every access, and every answer withheld, is logged in your environment under your retention rules.

Logs can be sent to Splunk, Sentinel, or any destination you choose.

Our staff have no standing access to your data.

Emergency access exists only to restore service. It requires your approval, is limited in time, is logged, and is set out in your contract.

We collect operational signals (response times, errors, when an answer was corrected) so the product improves. They contain none of your content.

Deeper analysis runs inside your environment, and only aggregate results leave it. Anything more requires your explicit consent.

We never train models on your data. You can see the full list of signals, and switch them off.

You own your data and the record built from it. If you leave, it's exported to you in an open format and deleted from our systems.

Omnisce supports your obligations under GDPR and CCPA, and a data processing agreement is available. A current list of subprocessors is available on request.

We don't yet hold SOC 2 or ISO 27001 certification. Omnisce was built with both in mind, and we'll pursue them as we grow.

Until then, we'll walk your team through the architecture and controls in detail, and complete your security questionnaire.

Questions, or a vulnerability to report: [email protected]