1. Overview
Physical AI systems have physical consequences, so we treat security as part of the architecture rather than a layer added later. This page describes how we secure this website and the information you send through it. Security documentation for client engagements is provided directly to customers, under a non-disclosure agreement where appropriate.
2. Hosting and infrastructure
- The website is hosted on Amazon Web Services (AWS Amplify) and delivered through the Amazon CloudFront global content delivery network.
- All traffic is encrypted with HTTPS/TLS, using certificates managed by AWS Certificate Manager. HTTP Strict Transport Security (HSTS) tells browsers to use only encrypted connections.
- The site is static. It has no user accounts, no passwords and no database exposed to the internet.
3. Browser-level protections
- A strict Content Security Policy allows scripts, fonts and connections only from approved sources, which blocks most cross-site scripting and injection attacks.
- Headers stop other sites from embedding our pages (clickjacking protection), stop browsers from guessing file types, limit referrer information, and turn off camera, microphone and location access.
- No third-party tracking runs before you consent. Google Analytics loads only if you opt in, as described in our Cookie Policy.
4. How inquiries are protected
- The contact form sends data over HTTPS to a serverless AWS pipeline (Amazon API Gateway and AWS Lambda) that delivers inquiries to our team. The form doesn’t store submissions in a website database.
- Every field is validated on the server, and the API accepts requests only from our own domains.
- Automated spam submissions are filtered out before they reach our team.
- The function that handles the form follows least privilege: it can publish to a single notification topic and nothing else. No credentials are exposed in the website’s code.
- Application logs are kept for 30 days.
For how we use and retain personal information, see our Privacy Policy.
5. Enterprise security reviews
If your organization is evaluating Omnibot Cloud, we’re happy to complete security questionnaires and discuss our security practices for your engagement. Email support@omnibotcloud.com with “Security review” in the subject line.
6. Reporting a vulnerability
If you believe you have found a security vulnerability in this website or any Omnibot Cloud system, please report it privately to support@omnibotcloud.com with “Security” in the subject line. Please include enough detail for us to reproduce the issue.
When researching, please:
- Don’t access, change or delete data that isn’t yours
- Don’t run denial-of-service attacks, spam or social engineering against us or our staff
- Give us reasonable time to fix the issue before telling anyone else about it
We won’t take legal action against good-faith research that follows these guidelines. Our machine-readable contact is published at /.well-known/security.txt.