Trust & Security
Security by Design.
Not by Declaration.
Every forensic record generated by OmniSentient is cryptographically verifiable, tamper-evident, and independently auditable.
-
Where does our code go?
Dependency manifests only, by default.
Automated remediation reads manifests, not source. Source is read and stored only if you switch on Code Intelligence, per repository.
Privacy Policy → -
Who else touches it?
Four subprocessors, all named.
Supabase, Vercel, Google Cloud and GitHub. What each one receives, and where it sits, is listed rather than summarised.
Subprocessor Disclosure → -
What happens if you are breached?
72 Hours to notification.
4 Hours to acknowledgement, 14 business days to a published root-cause report.
Security Policy → -
Can I prove any of this myself?
Yes, offline, without asking us.
Every forensic export is Ed25519-signed. The public key is published and the verification runs in seven lines.
Verification Guide →
Why We Are Trustworthy
Philosophy
Security is structural, not aspirational.
We do not claim to be unhackable. We claim to be auditable — and we can prove it.
Tamper Evidence
Every ledger row carries the SHA-256 hash of the row before it, written by a Postgres trigger. Altering or removing a row breaks the chain from that point on, and the break is detectable by anyone holding an earlier export.
Our own backend connects as the Postgres service role, which bypasses row-level security. We do not claim we cannot write to the ledger. We claim you can tell if we did.
anchor_incident_chain trigger on incident_events
Transparency
All system events — RBAC decisions, webhook verifications, AI analyses — are written to the hash-chained audit ledger with actor identity and UTC timestamp.
Exportable as signed CSV; auditors read it at /auditor
Verification
Our security claims are not self-attested. Every forensic export carries an Ed25519 signature you can check against the public key we publish.
Public key at /security/public-key
How It Works
From webhook to signed evidence.
Every step in the pipeline is cryptographically bound to the next. No gap, no bypass.
Independent Verification
Verify any report yourself.
You don't have to trust us. You can independently verify the integrity of every forensic export using standard cryptographic tools.
import csv
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
rows = {r[0]: r[1] for r in csv.reader(open("forensic_incidents.csv")) if len(r) == 2}
key = Ed25519PublicKey.from_public_bytes(bytes.fromhex(rows["# PROVENANCE_PUBLIC_KEY"]))
key.verify(bytes.fromhex(rows["# FORENSIC_SIGNATURE_ED25519"]),
rows["# CANONICAL_MANIFEST"].encode())
How We Operate
Implementation
What we've actually built.
Four layers of defense. Every control is verifiable — not aspirational.
Bug Bounty
Found something? Here's what happens next.
We take every report seriously. We acknowledge within 48 hours and credit researchers who help us improve.
Governance
Bug Bounty Scope
What is and isn't in scope.
Discover exactly what security research is eligible, what is excluded, and how to report findings responsibly.
Certifications
Compliance roadmap.
Formal certifications are revenue-triggered. Controls infrastructure is already in place.
| CERTIFICATION | STATUS | TARGET | NOTE |
|---|---|---|---|
| SOC 2 Type I | Planned | Revenue-triggered | Architecture audit complete. Awaiting formal audit engagement. |
| SOC 2 Type II | Planned | Post Series A | Continuous controls monitoring infrastructure is in place. |
| ISO 27001 | Future | Enterprise contract driven | ISMS policies documented. Formal certification enterprise-contract triggered. |
| FedRAMP | Future | Government market entry | Relevant for US federal procurement. Not a current target. |
Enterprise
Ready for procurement.
Documentation, architecture reviews, and vendor assessments available upon request.
Contact
Report a Vulnerability