Security at Omni
Sign-in. Accounts use an established identity provider (AWS Cognito). Passwords are stored hashed; we cannot see them. Google sign-in is supported.
[Add MFA if offered.]
Access control. Your projects are private by default. Access to a shared project follows the role you give (viewer or editor), enforced in the database as well as the app.
In transit and at rest. Traffic uses HTTPS. Data is stored on AWS and Supabase with encryption at rest
[CONFIRM].Operations. Production access is limited. Changes go through review and automated tests before release. Errors are monitored.
Plugin. The Figma plugin uses a short-lived pairing code and acts only on your behalf.
Backups.
[CONFIRM frequency and retention.]
Reporting a vulnerability. Email security@canvs.in with details and steps to reproduce. Please do not access other people's data, degrade the service, or disclose the issue publicly before we have fixed it. We will acknowledge within [3] business days, keep you informed, and credit you if you like. We do not currently run a paid bounty. [Add a safe-harbour sentence once counsel agrees.]
security.txt (host at /.well-known/security.txt):
Build things that last
We work on serious products and partner with teams who think long-term. If that sounds like you, we should talk