Hosting in London
OmniaGraph runs on Amazon Web Services in the London region (eu-west-2). Uploaded files are stored in a private Amazon S3 bucket in the same region, with public access blocked.
TrustSecurity and data handling
Where your data goes, and who can see it.
Investors and lenders put private documents next to public evidence. This page sets out where OmniaGraph runs, how those documents are protected and which companies process data for us.
HostingAWS, London region
DocumentsEncrypted, one workspace each
Sign-inInvitation only, emailed codes or Rodan
How data is protected
Stored in London. Encrypted. Kept apart.
Public research is shared by every client. Your watchlists, monitors, findings and private documents belong to your workspace alone.
Private documents are encrypted
Each uploaded file is encrypted by the application before it is stored, and its extracted text, sections and summaries are encrypted in the database. S3 adds its own encryption at rest.
Each workspace is kept apart
Every document belongs to one workspace. It can be attached only to that workspace's monitors, and searches only reach that workspace's documents and the public research every client shares.
Private material stays out of exports
CSV and JSON exports leave private material out by default. It is included only when someone with permission to use private documents asks for it explicitly.
Encrypted in transit
The site, the app and the API are served over TLS 1.2 or 1.3, and plain HTTP is redirected to HTTPS. Browsers are told to use HTTPS only for a year (HSTS). Session cookies are marked Secure and HttpOnly.
Signed webhooks
Every webhook is signed with HMAC-SHA256 over its timestamp and body, so your system can check that it came from OmniaGraph and was not changed.
AI models
What is sent to AI models, and why.
To read a document and extract findings from it, OmniaGraph sends its text to an AI model. Embeddings, the numeric index used to search your documents, are made the same way.
Through one gateway
Monitor runs, document reading and search send model requests through OpenRouter to the providers listed below.
No collection for training
Each of those requests tells OpenRouter to use only providers that do not collect the data they are sent.
Only what the task needs
A monitor sends the sections of a document that match its questions, not the whole workspace.
Access
Who can sign in, and what they can do.
Access is granted by your workspace owner, and the strongest permissions are off until they are needed.
Invitation only
Nobody can create an account. A workspace owner invites each user.
No passwords
OmniaGraph stores no passwords. Users sign in with a six-digit code sent by email. Codes expire after 10 minutes and allow five attempts.
Optional sign-in with Rodan
Where it is switched on, a user who already has an OmniaGraph account can sign in through a Rodan account, a login operated by Rodan Analytics Limited. It creates no accounts, accepts no invitations and sets no roles, and the emailed code stays available.
Roles
Owners, members and viewers. Viewers can read findings but cannot use private documents.
Private documents are off by default
A workspace must have private documents turned on, and a user must have permission to use them.
Keys stored as hashes
API keys and access tokens are stored as SHA-256 hashes, never as the key itself.
Logged operator access
A small number of OmniaGraph operators can open a workspace to support it. Each time they do, it is logged.
Companies that process data for usSub-processors
CompanyUsed for
Amazon Web ServicesHosting, file storage and deployment, in London
CloudflareDNS, network protection and bot checks at sign-in
OpenRouterRoutes requests to the AI models listed below
OpenAI, Anthropic, Google, Perplexity and xAIAI models that read documents and extract and check findings
ExaWeb search for public sources
MailgunEmail delivery of sign-in codes and briefs, in the EU
Rodan Analytics LimitedThe Rodan login, for sign-in with a Rodan account. It receives users' names and email addresses, and nothing from workspaces
SentryError reports, without personal data
PostHogProduct analytics, on its EU instance
For a security questionnaire, or to ask us to export or delete your workspace's data, email [email protected].