● Last updated 15 October 2026
Security
The Omni API handles your API keys, credit and the requests you send to AI models. This page describes how we protect them.
Controls
| Encryption in transit | Every connection uses HTTPS with HSTS. The connection from our servers to the database is encrypted with TLS 1.3. |
| Backups | The database is backed up every night, encrypted with AES-256, and each copy is kept for 30 days in private storage. |
| API keys | Keys are shown once and stored only as SHA-256 hashes. You can revoke any key instantly from the dashboard. |
| Payments | Card details go straight to Stripe (PCI DSS Level 1). We never see or store card numbers. Payment webhooks are signature-checked. |
| Your content | Prompts, files and outputs pass through to the model provider and back. We do not store them or use them for training. |
| Isolation between customers | Every task, cloned voice and pronunciation dictionary is tied to the account that created it; no other account can read or use it. |
| Abuse protection | Per-key rate limits, limits on sign-in codes, and lockouts after repeated failed sign-ins. |
| Admin access | The admin console needs a password plus a one-time code emailed to the admin, every time. Passwords are stored as scrypt hashes. Admin changes are written to an audit log. |
| Web protections | A strict Content Security Policy, no framing (clickjacking protection), same-origin checks on every account change, and HttpOnly, Secure session cookies. |
| Outbound requests | Files and webhooks you point us at must be public HTTPS addresses; private and internal networks are blocked. |
| Software updates | Dependencies are checked for known vulnerabilities and patched promptly. |
| Data retention | Sign-in codes are deleted after 7 days, security records after 30 days, and task result links after 90 days. You can export or delete your account at any time. |
Compliance
- GDPR and UK GDPR: clear legal bases, a published list of processors, storage limits, and self-service data export and deletion. See the privacy policy. Data Processing Agreements are available on request.
- Payments: handled entirely by Stripe, which is PCI DSS Level 1 certified.
- Infrastructure: our hosting, database and email providers (Vercel, Railway, Cloudflare) each hold their own SOC 2 Type II reports.
- SOC 2: the Omni API does not yet have its own SOC 2 report. Our controls are designed around the SOC 2 Trust Services Criteria and we are preparing for an audit.
Report a vulnerability
Email support@omni-api.rcinc.app with the details and steps to reproduce. Please give us reasonable time to fix an issue before disclosing it, and do not access other people’s data or disrupt the service while testing. We reply within 3 business days.