Security
How Omexa handles your data, your sessions and your customers' records.
One organisation cannot read another
Every record in every product belongs to a tenant, and every request is scoped to the tenant in the signed-in session rather than to anything the caller sends. This is covered by automated tests that run two organisations against one database and assert each sees only its own rows.
Sign-on
Omexa signs a short-lived access token for each session. Products verify it with a public key and accept only that signature type, so holding the public key does not let anyone mint a token. Access tokens are kept in memory, never in local storage, and the refresh cookie is scoped to the sign-in routes alone.
Access inside your organisation
Owners and admins run the organisation. Everyone else holds the role you gave them in each product, and a role change applies on their next request rather than when their token expires.
Super admin access
Omexa staff can open a customer workspace to help, with a short-lived session that ends when it expires. Every such action is recorded in an audit log, and the console shows plainly when somebody is viewing as you.
Credentials you give us
Channel credentials, such as a WhatsApp access token, are encrypted before they are stored, and are only ever used for the workspace that supplied them.