Security

Omnipresence measures how a brand shows up in AI assistants. It works from three things you give it: the public prompts you want to track, your brand and domain, and — optionally — an AI provider key so probes run under your own account. It sends those prompts to AI providers, records the answers and the sources they cite, and shows you the results over time.

What it does not touch is just as important: we do not ingest your internal documents, your product or PIM data, or your customer records. Your proprietary content stays in your systems. What we store is the public query, the public AI answer, the cited URLs, and your configuration.

All customer data — the database and authentication — is stored in AWS us-east-1 (United States). Application compute runs on Railway. We do not replicate customer data outside that region.

• In transit. All traffic to the application and its APIs is served over TLS (HTTPS).
• At rest. The database is encrypted at rest by the platform. Secrets and any AI provider keys you supply are additionally encrypted at the application layer before they are stored, so a key is never held in plaintext.

• Sign-in. Members authenticate with a magic link, one-time code or Google sign-in. Passwords are never stored by us.
• Agent access (MCP). When you connect Omnipresence to an AI assistant, the connection uses OAuth 2.1 with PKCE. Access is granted through an account-scoped token that only reaches that account's projects, and can be revoked at any time.
• Roles. Accounts have Admins and Marketers; a Marketer only reaches the specific projects they are granted.

Every account's data is separated at the database level: access rules are enforced by the database itself (row-level security), and the service additionally checks project access on every request. One account cannot read or write another account's projects, and an agent connection is confined to the account that authorised it.

We rely on a small set of sub-processors, each scoped to one purpose:

• Supabase — Database and authentication (hosted on AWS us-east-1).
• Railway — Application hosting and compute.
• Stripe — Payments and subscription management. Card details never reach our servers.
• OpenAI — Running measurement probes against ChatGPT models.
• OpenRouter — Gateway that routes measurement probes to Anthropic (Claude), Google (Gemini) and Perplexity.
• DataForSEO — Search-demand and SERP data used to size and rank tracked queries.
• Resend — Transactional email such as invitations, billing notices and digests.
• Google Tag Manager — Analytics on the public marketing pages only — deliberately not loaded inside the authenticated application.

Measurement history is retained while your account is open, because long-run comparison is the point of the product. When you ask us to delete your account we remove your personal and project data within 30 days, except billing records we must keep for tax and accounting. You can request an export of your data at any time.

If you believe you have found a security issue, or need to reach us about one, email [email protected]. We investigate reports promptly and will keep you informed. If we become aware of a breach affecting your data, we will notify affected account holders.

A Data Processing Agreement is available for customers who need one — see our DPA or email [email protected].