Approvals by default
Sending, spending and changing records wait for your approval by default.
Security and trust
Security and control you can verify
What is in place today, and what is not.
Four ways Omni keeps you in control
Every decision logged
AI actions are logged with who, what and when. Approvals record who said yes.
Role-based access
Roles decide what your team can do. Owners and admins grant each AI employee its tools.
Encrypted credentials
The credentials you connect are stored encrypted with a standard method (AES-256-GCM).
Sam
Compliance and checks
In Real Estate, Sam keeps watch on licenses, insurance, consent and deadlines. Sam is built not to file anything or move funds.
Activity log
See who did what, and when, in your workspace.
| Time | Who | Action | Details | Status |
|---|---|---|---|---|
| Today, 10:31 AM | Nora | Requested approval | Send a reminder for invoice #1042 | Pending |
| Today, 10:26 AM | You | Approved | 3 follow-up texts to inquiries | Completed |
| Today, 10:24 AM | Mia | Requested approval | Send 3 follow-up texts to inquiries | Approved |
| Today, 9:41 AM | Reggie | Drafted | Review requests for 2 customers | Completed |
| Today, 8:55 AM | You | Updated | Changed a team member's access | Completed |
| Yesterday, 4:33 PM | Sam | Checked | An application against its documents | Completed |
| Yesterday, 2:17 PM | Cody | Requested approval | Send a follow-up about a listing | Declined |
| Yesterday, 1:09 PM | Sam | Flagged | An insurance certificate expires next month | Pending |
Nothing matches. Choose All activity.
Illustration with sample data. Every business and person shown is fictional.
Sample data firstIn the free workspace, customer calls, texts and emails are simulated until you go live.
All-inclusive AI usageAI usage, AI calls and AI texts are included in your plan. No credits to buy.
AI disclosureCallers who ask are told they are speaking with an AI assistant.
Testing
How we test what we build
In-house penetration testing
Our security team attacks what we build, with permission, on staging and before anything goes live. A summary is available on request.
Prompt injection testing
Emails, documents and web pages can hide instructions meant for the AI. For example:
- A customer email that tells the AI to ignore its rules.
- Hidden text on a web page the AI reads.
- A document that carries instructions inside its text.
Our team tests AI employees against attacks like these before release, and checks that each one stays inside its limits.
This is our own team's testing. We have no third-party certificate or audit report to share and make no compliance claim today.
Approvals
How an approval works
Reading and drafting happen on their own. Sending, spending and changing records wait for your approval by default. A few channel settings, such as Gmail auto-reply, can send on their own; they are listed in Settings.
You see the reason and the exact changeEach request shows why the AI wants to act and what happens if you approve.
An approved action runs onceA result is reported only after the approved action has run.
If it fails, retry without a duplicateA failed action can be retried without a second approval or a duplicate.
Unanswered requests expireA pending request expires after 60 minutes by default, and an expired request does not run.
Owners and admins decideEdits, outbound messages, estimates, invoices, assignments and financial changes wait for an owner or admin.
Needs your approvalExpires in 60 minutes
Send a payment reminder to Brooks Plumbing
WhyInvoice #1042 for $1,240 is overdue.
If approvedThe reminder is sent once from your business email, and the invoice record is updated.
Activity log
See other outcomes:
Illustration with sample data. Nothing is sent.
What we can say today, and what is in progress
What we can say today
These are the measures in place now. Written from the product as of October 2026.
| Area | What this means | Status |
|---|---|---|
| Connections | Connections use HTTPS. | In place |
| Credentials | Credentials you connect, for example Twilio and Gmail, are stored encrypted with a standard method (AES-256-GCM). | In place |
| Backups | Database backups are encrypted off-site, with tested restores. | In place |
| Data separation | Each business's data is logically separated from every other business's data (by tenant) and protected by role-based access. | In place |
| Roles | Built-in roles, owner and admin among them, plus custom roles you define, decide what your team can do. | In place |
| AI employee tools | Each AI employee can use only the tools an owner or admin grants it. | In place |
| Approvals | Sending, spending and changing records wait for your approval by default. A few channel settings, such as Gmail auto-reply, can send on their own; they are listed in Settings. | In place |
| Activity log | AI actions are logged with who, what and when. High-stakes workflows write to a log that shows if anyone edits it. | In place |
| Your data | Owners can export customers, leads, jobs, invoices and estimates. | In place |
| Card numbers | Omni does not store card numbers. Card payments are available through Stripe. | In place |
| Sign-in | Optional two-step sign-in by email or text code. | In place |
| Penetration testing | Our in-house security team runs penetration tests on everything we build, on staging, before it goes live. A summary is available on request. | In place |
| Prompt injection testing | Our in-house security team tests AI employees against instructions hidden in the emails, documents and web pages they read, before release. | In place |
| Uptime SLA | An uptime commitment is available for your workspace. Ask us for the details. | In place |
| Private cloud, VPC or isolated database | Each business's data is kept separate from every other business's data (by tenant) as standard. Private cloud, VPC and isolated database options are available on request. | In place |
| Never used for training | Your customer data, call recordings and transcripts are not used to train AI models without your explicit written consent. | In place |
| Access reviews | Regular reviews of who has access to what. | In place |
| Activity log alerts | Alerts reach you when the activity log records something that needs attention. | In place |
What is in progress
In progress means the work has started. None of these is a certificate, a report or a promise yet.
| Item | What this means | Status |
|---|---|---|
| SOC 2 or ISO 27001 | We are working toward SOC 2 and ISO 27001. There is no audit report or certificate to share yet. | In progress |
| HIPAA, PCI, GDPR, CCPA or TCPA readiness | Readiness work for these frameworks is in progress. Regulated workloads are scoped case by case, and the business remains responsible for its own compliance. | In progress |
| Required two-step sign-in | An owner can switch it on for everyone. Today it is optional. | In progress |
| Retention and deletion | Controls for how long protected data is kept and how it is removed. | In progress |
| Website limits | Limits on which websites an AI employee may use. | In progress |
Questions
Frequently asked questions
Does the AI act without asking me?
Reading and drafting happen on their own. Sending, spending and changing records wait for your approval by default, and every decision is logged. A few channel settings, such as Gmail auto-reply, can send on their own; they are listed in Settings.
Do you hold any security certifications?
Not yet. SOC 2 and ISO 27001 are in progress, and so is readiness for HIPAA, PCI, GDPR, CCPA and TCPA. We make no compliance claim today: regulated workloads are scoped case by case, and the business remains responsible for its own compliance. Card payments are available through Stripe, and Omni does not store card numbers.
Is my data used to train AI models?
No. Your customer data, call recordings and transcripts are not used to train AI models without your explicit written consent. AI employees work by sending the records and messages they are working on to the AI and voice providers that run them. If that matters for your business, talk to a person before you connect real records.
How can I get a copy of my data?
You own your business data. Owners can export customers, leads, jobs, invoices and estimates at any time, and we will help with a full handoff on request.
Which actions should stay behind approval?
Start with the actions that carry risk: pricing and discounts, refunds and anything that moves money, emergency dispatch and arrival promises, warranty wording, complaint replies and sensitive collections messages. You decide which approval gates to keep and what, if anything, may run on its own.
Questions?
Have more questions about security?
Talk to a person. We will say what is in place and what is not.