Our approach
Security is treated as a property of the architecture rather than a feature added afterwards. The platform is designed so that the blast radius of any single failure is contained: tenants are isolated, privileges are minimal by default, and consequential agent actions can be gated behind human approval.
This document describes the measures in place as at the date above. It is incorporated into our Data Processing Addendum as the description of technical and organisational measures. We may improve these measures over time, provided the overall level of security is not materially reduced.
We are a pre-launch company and do not yet hold a SOC 2 or ISO 27001 certification. We set out our roadmap plainly below rather than implying assurances we have not yet earned.
Encryption
- All traffic to and from the Service is encrypted in transit using TLS 1.2 or above, with modern cipher suites and HTTP Strict Transport Security
- Data at rest is encrypted using AES-256 at the managed database and object storage layers
- Secrets and API credentials are held in a managed secret store, encrypted at rest, and never committed to source control
- Passwords are stored only as salted one-way hashes; we cannot recover a plaintext password
- Full payment card numbers never reach our infrastructure and are handled exclusively by our PCI DSS compliant payment processor
Access control
- Role-based access control within each workspace, so users see only what their role permits
- Row-level authorisation at the database layer, scoping every query to the tenant that owns the data
- Least-privilege administrative access, granted on a need-to-know basis and reviewed periodically
- Multi-factor authentication required for administrative access to production systems
- Access revoked promptly on role change or departure as part of a documented offboarding process
- Administrative actions on production systems are logged
Infrastructure and tenant isolation
- The Service runs on managed cloud infrastructure operated by the providers named in our Sub-processor List
- Logical tenant isolation is enforced in the data layer rather than relying on application code alone
- Production, staging, and development environments are separated, and production data is not used in development
- Backups are encrypted, taken continuously, and purged on a rolling window of up to 90 days
- Recovery procedures are documented; restoration testing is scheduled before general availability and will be noted in this document when completed
Secure development
- Version control with peer review required before changes reach production
- Automated type checking and static analysis in continuous integration
- Dependency vulnerability scanning, with prompt remediation of high-severity findings
- Secrets scanning to prevent credentials entering the codebase
- Infrastructure and configuration managed as code, so changes are reviewable and reversible
Monitoring and logging
- Application error and performance monitoring with alerting on anomalies
- Audit logging of authentication events, administrative actions, and agent executions
- Security and audit logs retained for up to 12 months
- Agent runs are traceable, so a customer can reconstruct what an Omni Force did and why
Human supervision of autonomous execution
Autonomous agents introduce a category of risk that conventional software does not: they act. The platform therefore treats human approval as a first-class control rather than an afterthought.
Customers can require human confirmation before an Omni Force takes a consequential action, restrict the tools and channels available to each agent, and review a full execution trace after the fact. We contractually require customers to maintain meaningful human supervision over actions that create legal obligations, move money, or affect an individual's rights.
Incident response
We maintain a documented incident response process covering detection, triage, containment, eradication, recovery, and post-incident review. Incidents are assigned a severity that determines escalation and communication.
Where an incident constitutes a personal data breach affecting Customer Personal Data, we notify affected customers without undue delay and in any event within seventy-two hours of becoming aware, as set out in our Data Processing Addendum. We do not delay notification in order to finish investigating.
Availability
We operate against an internal availability target of 99.9% monthly uptime for the core platform, excluding scheduled maintenance and events outside our reasonable control.
This is an engineering target, not a contractual service level. We do not currently offer a service level agreement with financial remedies on standard plans. Any binding availability commitment must appear in a signed order form. No uptime figure in our marketing material constitutes a guarantee.
Compliance roadmap
We state our position plainly rather than implying certifications we do not hold.
- GDPR and UK GDPR: Data Processing Addendum available, Standard Contractual Clauses incorporated — in place
- United States state privacy laws: service provider terms and rights handling — in place
- EU–US Data Privacy Framework: certification intended, not yet completed
- SOC 2 Type II: planned, not yet undertaken
- ISO/IEC 27001: under evaluation
- Independent penetration test: planned; we will publish a summary of findings (redacted) under NDA on request once completed
Your responsibilities
- Protect account credentials and enable available account protections
- Configure roles so users have only the access they need
- Set approval requirements appropriate to the risk of the actions your agents can take
- Do not submit special category data unless expressly agreed in writing
- Obtain a valid legal basis and any required opt-in before messaging your contacts
- Report suspected security issues to [email protected] without delay
Reporting a vulnerability
We welcome coordinated disclosure. Report suspected vulnerabilities to [email protected] with enough detail to reproduce the issue. We will acknowledge within three business days and keep you informed of remediation progress.
Please do not access, modify, or exfiltrate other users' data, degrade the Service, or run automated scanning that affects availability. We will not pursue legal action against researchers who act in good faith and within these boundaries. We do not currently operate a paid bug bounty.
Contact
Eyeleven Inc. — Security. Reach us at [email protected]. For security questionnaires, due diligence requests, or a copy of this document as a signed annex, contact [email protected].