Security Overview
Placeholder draft · Last updated 6 July 2026
Placeholder draft — this document has not yet completed legal review and is not legal advice. Final text must be reviewed before client contracting.
1. Sign-in
Authentication is handled by Supabase Auth. Sign-in methods are password and — where configured for the deployment — magic link and Microsoft single sign-on.
2. Tenant isolation
PostgreSQL Row-Level Security (RLS) is designed to act as the tenant-isolation boundary, with database policies intended to scope customer records to the signed-in user's tenant. Application records carry per-tenant scoping, and access within a tenant is further narrowed by roles and permissions. An internal tenant-isolation verification suite runs in continuous integration and has been run against the live database at its current schema version, with the tenant-isolation and permission checks passing. Verification is repeated per environment, and formal evidence accompanies customer contracting rather than this page.
3. Auditability
The product maintains a structured audit-support trail of who did what, when, across escalation records. Data exports are permission-gated and audited.
4. Application hardening
The application is served with a Content Security Policy and related security headers (frame denial, content-type protection, referrer policy). Attachment storage is designed to be private, with access mediated by the application rather than public URLs.
5. AI and customer data
OgmaQ's customer-facing product currently has no AI functionality. OgmaQ does not process customer tenant data through AI providers, no AI vendor is currently a subprocessor of customer tenant data, and customer workspace content is not used to train AI models. Any future customer-facing AI-assisted functionality would require separate documentation, configuration, customer-facing disclosure and review before being enabled. Internal company tooling used outside the customer-facing product is separately scoped and controlled, and does not involve customer tenant data.
6. Program status
OgmaQ's security program is under active development toward first-client readiness. We do not currently hold, and do not claim, third-party attestations such as SOC 2 or ISO 27001. This page describes the design honestly rather than making assurance claims.
7. Reporting a vulnerability
If you believe you have found a security issue, please tell us — see the responsible disclosure policy. Security reports: [email protected] ([email protected] also reaches the same team). Machine-readable details are published at /.well-known/security.txt.