Security and Compliance at Omnistrate¶

Omnistrate delivers enterprise-grade security and compliance for your SaaS products across all deployment channels. Our platform is designed to help you implement robust security controls, maintain governance, and meet industry standards with ease.

For the latest information about Omnistrate's security posture, compliance status, controls, and available assurance documents, visit the Omnistrate Trust Center.

Our Security Practices¶

• SOC 2 Type II: Omnistrate has successfully completed an independent SOC 2 Type II attestation, demonstrating that our security controls are appropriately designed and operate effectively over time. This independent assurance helps customers confidently build and operate secure SaaS products on Omnistrate. For more details, see our Type I and Type II announcements.
• ISO/IEC 27001: Omnistrate is ISO/IEC 27001 certified, demonstrating that its information security management system meets the requirements of the international standard.
• EU GDPR: Omnistrate maintains technical and organizational controls designed to support compliance with the European Union General Data Protection Regulation.
• HIPAA: Omnistrate maintains security and privacy controls designed to support workloads subject to the Health Insurance Portability and Accountability Act.
• Penetration Testing: We conduct regular penetration tests and make reports available upon request to ensure ongoing security and risk mitigation.
• Vulnerability Reporting: If you discover a security issue or vulnerability, please contact us at security@omnistrate.com. We will coordinate with you to securely address and resolve any concerns.

SOC 2 and ISO/IEC 27001 provide independent assurance of Omnistrate's controls. GDPR and HIPAA are regulatory frameworks and should not be interpreted as certifications. Your organization's compliance remains a shared responsibility based on how you configure, deploy, and operate your application.

Key Security Features¶

• Cloud Account Permissions: Permissions required to access your and your customers' cloud accounts, following minimum privilege principles
• Role-Based Access Control (RBAC): Enforce security policies to restrict access to resources and actions based on user roles and organizational context
• API Keys: Long-lived, org-scoped credentials for automation, CI/CD, and service-to-service authentication
• Secrets Management: Secure handling of sensitive configuration
• Customer Networks: Network isolation and VPC integration
• SSO / Identity Providers: Enterprise authentication and identity management
• Operational Status Page: Communicate real-time status to your users
• Audit Logs: Track user actions and system events across your SaaS products for accountability and compliance

Compliance Resources¶

The resources in this section help you evaluate Omnistrate's controls and support your own security and compliance programs. Using Omnistrate does not automatically certify your application or self-service portal.

• Trust Center: Review current compliance frameworks and security controls, and request access to available reports and assurance documents in the Omnistrate Trust Center.
• SOC 2 for your control plane: Use Omnistrate's independently attested controls and supporting documentation as inputs to your SaaS product's own SOC 2 program.
• Security questionnaire: Access a common compliance questionnaire report, including resources like the AWS FTR checklist, to streamline your review process.
• Pen test report: Review details about our penetration testing program. If you require a custom report, please contact support@omnistrate.com for assistance.

Reporting Security Issues¶