Security
How we protect your business
You're trusting us with your Google Business Profile and customer review data. Here is exactly what we do to protect it.
Last reviewed: July 1, 2026
Your Google credentials are never stored
When you connect your Google Business Profile, authentication happens directly between your browser and Google via OAuth 2.0. Ominvo receives an access token only — your Google username and password are never transmitted to or stored on our servers at any point.
All data is encrypted in transit and at rest
Every connection between your browser and Ominvo is encrypted via HTTPS/TLS. Your account data, review data, and AI responses are stored in Supabase with encryption at rest. We use industry-standard AES-256 encryption for stored data.
Your data is isolated from other businesses
Ominvo uses Supabase row-level security (RLS) on every table. This means database queries are enforced at the row level — your reviews, AI responses, and account settings are mathematically inaccessible to any other Ominvo user, even in the event of an application-level bug.
Your browser rejects common attack patterns
Every response Ominvo serves — every page, every API endpoint — carries a set of HTTP security headers that instruct your browser to reject a class of attacks even if we ship a bug that would otherwise expose you. Layered defense: RLS at the database, headers at the browser.
Shipped on all routes: X-Frame-Options: DENY (nothing embeds Ominvo in an iframe, preventing clickjacking), X-Content-Type-Options: nosniff (blocks MIME-type confusion attacks), Referrer-Policy: strict-origin-when-cross-origin (limits what external sites learn about which Ominvo pages you visit), and Permissions-Policy (denies camera, microphone, and geolocation access — Ominvo has no product feature that needs any of them).
We also ship a Content-Security-Policyheader that constrains what scripts, styles, images, and network calls the browser will honor. It's currently in report-only mode while we monitor for legitimate origins we may have missed — a defensive rollout pattern so we don't accidentally break a feature by locking down too aggressively. Once we're confident the allowlist is complete, we flip it to enforcing mode.
You can verify all of this yourself. Open your browser's developer tools on any Ominvo page — every header named above will be present in the response.
AI processing is review-text only
When you generate an AI reply draft, only the text of the review is sent to Anthropic's API. Your business name, email address, payment details, and account information are never included in AI processing requests. Anthropic's data usage policies apply to this data.
Payment data never touches our servers
All billing and payment processing is handled entirely by Stripe. Ominvo never sees, stores, or logs your card number, CVV, or full billing details. Our servers only receive a Stripe customer ID and subscription status.
Breach notification within 72 hours
In the event of a confirmed security breach affecting your data, we will notify you by email within 72 hours of discovery, in accordance with standard data breach notification requirements. We will include the nature of the breach, data affected, and steps we have taken.
Report a security issue
If you discover a security vulnerability in Ominvo, please email support@ominvo.com with the subject line “Security Disclosure”. We will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have had a chance to address them.