Controls you can inspect. Claims you can verify.
OM Chat treats tenant boundaries, provider credentials, webhook ingress, and release evidence as product architecture—not marketing fine print.
Current public posture
Implemented architecture
Defense in depth at the workspace boundary.
No single control is treated as enough. Identity, tenant scoping, server-only credential access, and signed ingress paths work together.
Authenticated access
Protected application and API routes require a verified Supabase session when production identity is configured.
Workspace isolation
Workspace membership, role checks, tenant-scoped repositories, and database RLS contracts form the data boundary.
Server-only provider secrets
Production credentials are designed to resolve through server-side Vault functions; browser clients receive redacted metadata, not raw keys.
Signed integration events
Webhook verification, same-origin mutation checks, rate limits, and scoped API credentials protect supported ingress paths.
Least-privilege roles
Owner, admin, builder, operator, and viewer permissions constrain workspace actions, including last-owner protection.
Release guardrails
Secret scanning, release identity checks, exact-commit smoke tests, and production-readiness gates make deployment state visible.
Trust ledger
Implemented, environment-dependent, and not claimed are different states.
The product reports those states separately so a secure design is never confused with an unfinished production configuration or an unearned certification.
| Control or claim | Current status | What that means |
|---|---|---|
| Tenant-scoped repository and RLS contracts | Implemented | Covered by repository, role, and schema contract tests. |
| Vault-only production credential storage | Implemented | Fails closed when the production Vault path is unavailable. |
| Live Supabase, scheduler, and provider configuration | Environment required | A workspace is only production-ready after the live environment passes health and smoke checks. |
| SOC 2, ISO 27001, HIPAA, or similar certification | Not claimed | No formal certification or attestation is represented on this site. |
| Official Meta partner status | Not claimed | Social-provider rollout does not imply a provider partnership. |
Responsible disclosure
If you believe you found a security issue, send a concise report with impact and reproduction steps. Do not access data that is not yours or disrupt the service.
Email the security ownerCustomer responsibilities
Protect your identity and provider accounts, choose least-privilege team roles, verify consent and messaging-policy requirements, and rotate a credential immediately if exposure is suspected.
Review acceptable useStart with evidence
Evaluate the architecture before you trust the automation.
Bring your security questions to a product walkthrough. We will separate implemented controls, live environment evidence, and roadmap work in plain language.