Tenant isolation
Each tenant's data is isolated. Your tracked vendors, private edits, and evaluation work are invisible to every other tenant, full stop.
Security & trust
Your data stays yours. Every claim carries its source.
Your evaluations, shortlists and documents stay private to your organization, and every surfaced fact traces back to its source. This page also sets out the evidence discipline behind every claim we make about OmniAxis itself.
Tenant isolation Evidence provenance GDPR & DPA posture
Trust posture
Trust is a product property, not an appendix
Three commitments organize this page: your data is isolated to your organization, every surfaced claim carries provenance, and the GDPR and DPA posture is set out below.
Security, risk, and legal reviewers gate every deal, so this page is written for them. Every commitment here is backed by a shipped mechanism, named in the sections that follow.
The same discipline governs how we describe OmniAxis itself: every claim about the product is one we can back with evidence, and evidence, not badges, carries the argument.
Everything on this page describes generally available controls. Nothing here depends on a roadmap item.
Data isolation
What you put in stays inside your organization
Your evaluations, shortlists, scores and the documents you upload are private to your organization. No other customer can see any of it.
Inside your organization, each person sees what their role allows. The isolation model is documented for your legal review alongside the DPA.
Governance controls
Five controls a risk reviewer can evaluate
Role-based access, tenant-private uploads, and governed exports can all be shown in a live working session. The isolation model and the DPA are documented for your legal review.
Role-based access
Per-tenant, role-based access keeps users to what their role permits. Evaluation workspaces carry lead, committee, approver, and observer roles, so least privilege holds inside your own team as well.
Tenant-private intelligence
Documents you upload are processed inside your tenant only. They are never shared cross-tenant.
Governed exports
Exports of your own data are IP-marked and leak-guarded, with per-section permission gating. You can hand a report to a client or a board without wondering what else rode along.
GDPR & DPA posture
Processing is GDPR-aligned. A Data Processing Agreement is available on request, and sub-processor detail lives in the DPA, where legal teams expect to find it.
Source transparency
Where the evidence comes from
Assessments rest on independent third-party evidence. Documentation you upload stays private to your tenant.
We do not publish the source catalog. A named list is a list a vendor can work backwards from, and evidence that can be targeted stops being independent. What you can inspect is the specific source behind any individual claim, in your own account, at the point the claim is made.
Financial-viability signals derive from documented records only. No private financial data enters an assessment, which means every financial signal we surface is one you could defend to a board or a regulator.
Independent third-party sourcing is what we hold ourselves to, and a gap in it is never filled with a guess.
Evidence discipline
How we keep every claim honest
Assessments are anchored to independent third-party evidence, so every one traces to a record you can inspect.
Every ROI or outcome figure we publish carries its evidence class, illustrative or modeled, so you always know whether you are reading a value hypothesis or a measured result.
The DPA includes a plain-English summary of what data is processed and why, and we state only the certifications we genuinely hold.
Claims are checked, labeled, and sourced. That discipline is the product, not a disclaimer.
Security and trust questions
The questions that come up most often in risk and legal reviews.
How is my data isolated from other tenants?
Every tenant operates in a private space. Your tracked vendors, uploads, annotations, and evaluation work are invisible to other tenants.
What happens to documents I upload?
They stay private to your organization, and only your own team can see them.
Where does the evidence come from?
From the independent documented record rather than from vendor marketing. We keep the source catalog private by design, because a published list is one a vendor can work backwards from. The source behind any single claim is visible to you at the point that claim is made. Documentation you upload is held privately to your tenant.
Do you lab-test products?
No. Assessments cover what the independent record already contains, and nothing is filled in with a guess.
Is any of the financial data private?
No. Financial-viability signals derive from documented records only.
Are you SOC 2 certified?
No. OmniAxis does not claim a certified SOC 2; certification is an open decision. The trust overview we share on request records the current status.
Do you offer a DPA, and are you GDPR-aligned?
Yes. Processing is GDPR-aligned, and a Data Processing Agreement, including sub-processor detail, is available on request.
How do you handle vendors' certification claims?
They are checked against the independent record, like every other claim a vendor makes.
Match the next step to where your review stands
Evaluators still building the file can request the DPA and trust overview; teams cleared to proceed can book a working session today.