Encryption in transit and at rest
TLS encryption protects data in transit across the platform. Sensitive data — including the WhatsApp, Meta, Telegram and email credentials you connect — is encrypted at rest with AES-256.
Security
Security & data protection
A plain-language summary of how the OmniDesk platform handles your data — encryption, hosting, access controls, retention and compliance posture. This page summarizes our privacy policy; where specifics are not public, we say so and offer the full dossier on request.
EU hosting, protected transfers
OmniDesk servers are located in the European Union. If you access the service from outside the EU, your information is transferred to and processed in the EU under standard contractual clauses approved by the European Commission.
You own your channels
Your business keeps ownership of its WhatsApp numbers, Meta pages, Telegram bots, SMS provider accounts and mailboxes. OmniDesk guides setup, validates permissions and stores only the credentials needed to operate your workspace.
Isolated workspaces & roles
Credentials, users, inboxes, automations, audit logs and reporting are isolated per client workspace. Owner, admin, manager, agent and viewer roles control who sees and does what — and a platform-admin support mode manages settings without reading customer chats.
Defined retention & deletion
Message history is retained for the duration of your subscription plus 90 days, then permanently deleted. Verified deletion requests are completed within 30 days. Every workspace includes daily backups.
No selling of data
OmniDesk does not sell your personal data or your customers' message data. Data is shared only with service providers under data processing agreements, when legally required, or with your explicit consent.
Compliance posture
GDPR, UAE PDPL and WhatsApp-safe sending
GDPR and CCPA rights. Depending on your location, you can request access, rectification, erasure, portability, objection and restriction of processing. Requests go to privacy@getomnidesk.com and are answered within 30 days by our Data Protection Officer. Billing card details are processed by Stripe; OmniDesk never stores full card numbers.
UAE PDPL alignment. Our guide on GDPR-compliant data governance for UAE support teams explains how the UAE's Federal Decree-Law No. 45 of 2021 (PDPL) aligns with GDPR principles — accountability, purpose limitation, security — so one governance framework covers both regimes. The same guide covers practical controls OmniDesk teams use: role-based access with least-privilege, encryption in transit and at rest, audit logs, consent ledgers and Data Protection Impact Assessments before rolling out new channels.
WhatsApp and email compliance, built in. Broadcasts are designed around channel providers' safe-sending guidance: WhatsApp messages go out 20-40 seconds apart with randomized jitter, a configurable per-number daily cap (default 250), an automatic "Reply STOP" opt-out, and auto-pause/resume at limits. Emails send within host-aware hourly/daily/monthly limits and carry one-click unsubscribe with RFC-8058 headers. Opted-out contacts are excluded from future campaigns automatically.
Good to know
Honest limits of this page
Public certifications (such as ISO 27001 or SOC 2) are not claimed on this website, so we do not claim them here. Penetration-test schedules, subprocessor lists, infrastructure details and the full security dossier are available on request — email privacy@getomnidesk.com and our team will respond under NDA where appropriate.
FAQ
Security questions, answered
Security questions for your procurement checklist?
Our team can walk your IT and compliance stakeholders through the details on a call.