A client just sent you a security questionnaire
Or you are about to hand your whole operation to a company you have not met. Either way the questions are the same three, and the answers are the same on every plan: none of this is an upgrade.
What stays yours
Your records leave when you do
Export items, customers, orders, stock and invoices to CSV whenever you want, on every plan. It is a button in the product rather than a support request, and it works the same on your last day as on your first.
Your payment account is yours
Card payments run through your own Stripe or Square account, straight to your bank. Omni is never the merchant of record, so the relationship with your processor is one we cannot come between.
Your customers hear from you
Email goes out through your own mail provider and your own domain, so your sender reputation belongs to you and stays with you.
Your business, separated from every other
Each tenant's records live in their own database schema. It is not a filter applied to a shared pile of rows; it is a separate set of tables, with a second layer beneath it that fails closed rather than open.
Is my data separate from other businesses'?
Yes, and not by a filter. Each tenant's records live in their own database schema — a separate set of tables rather than a shared pile of rows with a where clause in front of it. The separation is enforced beneath the application rather than by it, so it holds even when application code is wrong. Where it cannot be certain, it returns nothing rather than guessing — the only direction worth failing in.
The practical consequence is the one you care about: there is no query anyone could write, careful or careless, that reaches another business's records by accident.
Who on my team can see what?
You decide, per area of the business, separately for reading and for changing. A cashier can take payments without seeing margins. A buyer can raise purchase orders without reaching customer records. Roles arrive already configured for the trade you are in, so this is adjustment rather than construction.
Two things follow that matter more than they sound. Narrowing a role does not break someone's day — a scoped user lands on the screen their job starts from, not a dashboard of numbers they cannot act on. And turning access off takes effect at once for anything new; a session already open stops working within minutes rather than at some indefinite later point. We would rather say minutes and mean it.
Can I get my data out?
Whenever you want, on every plan, from a button inside the product. Items, customers, orders, stock and invoices, as CSV. Not a support ticket, not a fee, not a wait.
⭐ The part most vendors are quiet about: it still works after your trial ends. When a trial lapses Omni stops letting you run the business, but the export stays open deliberately, because data you cannot retrieve is data you no longer own. You do not need our cooperation, or our goodwill, to leave with what you came with.
How long we keep records after that, and in which categories, is set out in the privacy policy — the binding version of everything on this page.
The ordinary protections, stated plainly
Encrypted in transit and at rest
Connections are encrypted, and the credentials Omni holds on your behalf are encrypted again before they are stored. The specific methods move as the industry moves, and we would rather commit to the property than to this year's acronym.
Two-factor authentication, enforceable
Any user can turn it on. You can require it of everyone, or of your administrators specifically, with a grace period so nobody is locked out of their own business on the day you decide.
Least privilege behind the scenes
Access to production systems follows least-privilege principles, and administrative action on a tenant is itself an audited event.
A named list of who else is involved
Payment processing, email delivery and hosting involve other companies. They are named in the data processing agreement rather than described as a category, so you can check them rather than take our word.