How we protect your company’s work.
What we actually do today, in plain words. No badges we don’t have.
Separate companies
Every request is checked against the company you have open and your role in it. People never see a company they don’t belong to.
Roles that mean something
Owner, Admin, Manager, Member and Viewer. The server, not just the screen, decides what each role can do.
Encrypted in transit
All traffic uses HTTPS. Browsers are told to always use HTTPS for this site (HSTS).
Passwords
Stored only as bcrypt hashes. Sign-in attempts are rate-limited. Temporary passwords must be changed at first sign-in.
Sessions
Secure, HTTP-only, same-site cookies. Every change is protected against cross-site requests.
Where your data lives
On our own server in a data centre in Germany (EU), with nightly backups.
Your data, your call
Owners and admins can export everything as JSON and delete the company. Anyone can delete their own account.
No tracking
No advertising, no third-party trackers in the app, no selling of data.
Found a problem?
Please tell us at info@omneth.com. We read every report and answer quickly. See also security.txt.