Security

Last updated: September 27, 2026

Infrastructure

Ombra runs entirely on Google Cloud and Firebase. Hosting, database, functions, and file storage all live inside Google's infrastructure — no third-party servers sit in the path of your data. Data is encrypted in transit (TLS) and at rest, and stored redundantly within Google Cloud.

Access control

Sign-in via Firebase Authentication; sessions use short-lived tokens.
Role-based access: owners and managers can change financial data; staff roles are read-limited and fail closed — anything not explicitly allowed is denied.
Every workspace's data is isolated by server-side rules — a signed-in user can only read and write the workspace they belong to. Cross-workspace access is rejected.
POS credentials and API keys are stored server-side only, never in client code or the browser.

AI data handling

The AI analyst queries your workspace's data through server-side tools and never sees another business's data. Model calls run on Google Cloud's Vertex AI under Google's data-processing terms, carry no API keys in the browser, and per-user rate limits guard against abuse.

What we don't do

We don't sell your data or share it with advertisers or data brokers.
Employee access to production data is limited to what's needed to operate and support the service.
We don't train public AI models on your business data.

Incident response

If we discover a security incident affecting your data, we will investigate promptly, contain it, and notify affected customers without undue delay, along with steps we're taking.

Your role

Use a strong, unique password (8+ characters, uppercase, number, symbol) and don't share your sign-in.
Only invite people you trust to your workspace, and give each person the least-privileged role they need.
If you forget your password, we send a time-limited 6-digit security code to your email — not a guessable link.
If you suspect unauthorized access, change your password and tell us right away.

Encryption

OAuth tokens (Square, QuickBooks) are encrypted with Google Cloud KMS before storage — unreadable without the key.
All traffic uses HTTPS. Google encrypts the database at rest.
Sensitive credential access is audit-logged.

Reporting an issue

Found something? Tell us at info@ombrahq.com and we'll investigate promptly. Please don't probe other workspaces' data while testing — report what you found and how to reproduce it.