Security & Compliance

At OmniVani, security is not an afterthought—it is the foundational pillar of everything we architect. Modern enterprises rely on OmniVani to power mission-critical customer conversations, sensitive support tickets, and high-volume WhatsApp communication workflows. We employ defense-in-depth methodologies, continuous automated monitoring, and rigorous governance to keep your data protected at all times.

1. Cloud Infrastructure & Network Defense

OmniVani’s cloud environment is built upon top-tier, certified data centers engineered for high resilience and zero single points of failure:

• Certified Cloud Providers: Our compute clusters, databases, and message brokers are hosted within Amazon Web Services (AWS) and Google Cloud Platform (GCP) facilities adhering to ISO 27001, SOC 1/2/3, and PCI-DSS Level 1 certifications.
• Virtual Private Clouds (VPC): All production services run inside isolated private VPC subnets. Production database instances are strictly inaccessible from the public internet.
• Multi-Availability Zone (AZ) Resilience: All core databases, cache layers, and application nodes are distributed across geographically redundant availability zones with automated instant failover.
• DDoS & Perimeter Protection: Enterprise Cloudflare integration shields our web dashboards and public API gateways with intelligent rate limiting, Web Application Firewall (WAF) inspections, and automated DDoS mitigation.

2. Comprehensive Data Encryption

We ensure end-to-end cryptographic protection for all data across its entire operational lifecycle:

Encryption in Transit

• All incoming and outgoing web traffic, API calls, and agent dashboard sessions require TLS 1.3 (with TLS 1.2 fallback using strict cipher suites).
• HTTP Strict Transport Security (HSTS) with preloading is enforced across all domains to prevent protocol downgrade attacks.
• All outbound webhook notifications dispatched to customer endpoints utilize cryptographic HMAC-SHA256 signature verification headers.

Encryption at Rest

• All customer data, message contents, metadata stores, and uploaded media attachments are encrypted at rest using industry-standard AES-256.
• Database volumes and file storage repositories utilize AWS KMS / Cloud KMS managed cryptographic keys with automatic annual rotation.
• Rolling database backups and cold disaster recovery snapshots are encrypted with unique dedicated keys before distribution.

3. Identity, Authentication & Access Governance

Strict access controls prevent unauthorized access across both external and internal operations:

• Role-Based Access Control (RBAC): Granular permissions define what each team member can view and perform across your inbox, contacts, workflows, and billing settings (Owner, Administrator, Team Lead, and Agent roles).
• Multi-Factor Authentication (MFA): Enforced two-factor authentication via Time-Based One-Time Passwords (TOTP) and WebAuthn hardware keys.
• Enterprise Single Sign-On (SSO): Integration support for SAML 2.0, Okta, Microsoft Azure AD (Entra ID), and Google Workspace for centralized user provisioning and deprovisioning.
• Least-Privilege Internal Access: OmniVani team members do not maintain persistent production database access. Ephemeral Just-in-Time (JIT) access requires multi-person approval and is automatically terminated after task completion.

4. WhatsApp Business Platform Security

OmniVani leverages Meta’s official WhatsApp Cloud API, which maintains strict security protocols:

• Messages sent through WhatsApp operate on Meta’s hardened infrastructure with end-to-end encrypted protocol tunnels during mobile transit.
• Phone number registrations are secured via two-step PIN verification directly within the WhatsApp Business Account (WABA) container.
• Webhooks dispatched from Meta to OmniVani are authenticated using cryptographic secret tokens and SHA-256 message digests.

5. Continuous Vulnerability Management & Penetration Testing

We proactively audit our codebase and infrastructure through multi-tiered testing protocols:

• Automated CI/CD Scans: Static Application Security Testing (SAST) and Dependency Vulnerability Audits are automatically triggered on every software commit.
• Third-Party Penetration Testing: Independent CREST-accredited security firms perform annual gray-box penetration tests across our API endpoints and web applications.
• Dynamic Threat Monitoring: 24/7 SIEM monitoring continuously inspects runtime telemetry, analyzing anomalous patterns and privilege escalation attempts.

6. Business Continuity & Disaster Recovery (BC/DR)

We maintain an audited Disaster Recovery framework designed to guarantee fast recovery during unexpected disruptions:

7. Regulatory & Privacy Compliance

Our operational architecture adheres to major global privacy frameworks:

• GDPR & UK GDPR: Comprehensive Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs) for cross-border data handling.
• India DPDP Act: Compliant data handling, explicit purpose limitation, and consent-driven messaging architectures.
• SOC 2 Type II Alignment: Audited controls across Security, Availability, and Confidentiality trust service criteria.
• CCPA / CPRA: Full support for California consumer privacy requests and zero data sale warranties.

8. Responsible Vulnerability Disclosure Program

We welcome collaboration with ethical security researchers. If you discover a potential vulnerability within OmniVani services:

• Please email your findings directly to security@omnivani.com.
• Include reproducible steps, environment details, and proof-of-concept examples.
• We pledge to acknowledge receipt within 24 hours and investigate promptly under our Safe Harbor commitment.