Security & Privacy

Is my data secure?

Yes. All data is encrypted in transit and at rest using industry-standard encryption (AES-256). Each organisation's data is fully isolated — your business information, conversations, and credentials are never shared with or accessible to other businesses.

We treat security as a baseline, not a feature. Isolation between organisations is enforced at the database level, not just the application level.

A Data Processing Agreement (DPA), a formal document some businesses need to show how their suppliers handle personal data, is available on request.

Who can see my business data?

Only people you have given access to.

Omni processes your data to serve you: answering your questions and helping your customers. Your data is never used to train models, and the providers that process it are listed on our Security & Trust page.

How are my API keys and credentials stored?

All credentials — API keys, access tokens, and authorised connections — are encrypted with industry-standard encryption (AES-256) before storage. They are never logged, never displayed in the interface after entry, and never included in error reports or analytics.

If you need to update a credential, you replace it entirely rather than viewing the existing one. This is by design.

Can customers see my internal business data?

No. The customer-facing chat widget operates in a restricted mode. It can only access:

• Product information (names, descriptions, pricing, availability)
• Order lookups (when a customer provides their order number or email)
• Contact details and opening hours
• Content you've trained it on (FAQs, policies, service descriptions)

Your financials, margins, internal notes, supplier information, team communications, and business intelligence are never exposed to customers. This boundary is enforced at the system level, not just the prompt level.

What about my customers' personal data?

Customer data collected through the chat widget:

• Customer deletion: customers can request deletion of their personal data, and we process these requests promptly.
• Minimal collection: we only collect what's needed for the conversation. No hidden tracking or profiling beyond what you've configured.
• Cookie consent: the widget includes a consent mechanism for jurisdictions that require it.

For more detail on our security and privacy practices, see the Security Overview and Privacy Policy.