Privacy Policy
Our explicit commitment to zero-retention compliance AI, payload sanitization, tenant isolation, and regulatory data protection.
LAST UPDATED: SEPTEMBER 2026
Privacy Engineering & Data Minimization Commitment
At OMNiGRC, we design GRC software built on data minimization. This policy explains what metadata we collect, how advisory AI processes queries, and how we protect your security posture data.
01. Categories of Data We Collect
Work emails, team user roles, company domain names, and administrative audit log timestamps.
Control statements, asset tags, 5x5 risk scores, evidence upload metadata, and framework mapping choices.
02. AI Data Minimization & Zero-Retention Policy
When our Advisory AI engine evaluates framework clause alignment:
- Automated Payload Sanitization: All text payloads are automatically scrubbed for credentials, secret tokens, and PII before transmission.
- Zero-Training Guarantee: Customer data is NEVER used to train foundational AI models or public datasets.
- Zero-Retention Processing: Ephemeral API connections discard prompt context immediately upon generating suggestions.
03. Regulatory Safeguards & User Rights
We maintain architectural readiness under DPDP Act India 2023, EU GDPR, and ISO 27001 Annex A data handling standards.
Right to Portability
Export JSON/CSV posture
Right to Erasure
Permanent tenant purging
Auditability
Immutable change log
Have a Privacy or DPA Request?
Our Data Protection Officer can provide formal Data Processing Addendums (DPA) upon request.
Request DPA or Contact DPO