Security

Infrastructure & encryption

OmniCrabruns on Supabase-managed Postgres. All traffic between your browser, our servers, and the database is encrypted in transit (TLS), and data at rest is encrypted by the underlying database infrastructure. On top of that, secrets you provide directly — your own LLM API keys and connected channel tokens — are separately encrypted at the application layer before they're stored, with a versioned key so it can be rotated without breaking previously-stored secrets.

Data isolation

Every table that holds customer data — bots, conversations, messages, customer records, knowledge sources — is protected by Postgres row-level security policies scoped to your workspace. Application queries run through these policies, not just application-layer checks, so one workspace cannot read another workspace's data even if a query is malformed.

Webhook & integration security

Inbound messages from WhatsApp, Messenger, and Instagram are verified against Meta's request signature before we process them; Telegram messages are verified with a per-connection secret only your workspace and Telegram know. Retried deliveries are recognized and processed once, not duplicated. If you configure your own outbound webhook, its delivery status — delivered or failed, with the response code — is visible from your dashboard, not just assumed.

Activity logs

Each bot has its own activity log recording lifecycle events — publishing, configuration changes, integration connects and disconnects — visible from the bot's Activity tab.

API access & rate limiting

The platform REST API is authenticated per key and rate-limited. Platform API keys can be revoked instantly from your dashboard at any time. AI-invoking dashboard actions are separately rate-limited to keep any one workspace from overwhelming shared AI provider capacity. Every response also carries security headers (including a Content Security Policy and HSTS) that restrict what a page is allowed to load and enforce HTTPS.

Your data

You can download a copy of your workspace's data — bots, customers, conversations, and messages — at any time from Settings, and permanently delete your account from the same page. See our Privacy Policy for the full detail on data retention and your rights.

Privacy & cookies

Analytics cookies are only set after you accept them — see our Cookie Policy. For how we handle personal data more broadly, see our Privacy Policy.

Report a security issue

If you find a vulnerability, please email [email protected] with details — we don't yet have a bug bounty program, but we read and respond to every report.