---
title: "Security and trust at OmniChannels.ai"
description: "How OmniChannels.ai and BroadNet protect your messaging data: ISO 27001, ISO 27018, ISO 22301, SOC 2 Type II, GDPR, encryption and fraud controls."
canonical: "https://omnichannels.ai/security/"
language: "en"
updated: "2026-10-10"
publisher: "BroadNet Technologies"
brand: "OmniChannels.ai"
---

# Security and trust at OmniChannels.ai

Canonical: https://omnichannels.ai/security/
Language: en
Publisher: OmniChannels.ai by BroadNet Technologies

Customer messaging carries personal data and one-time passwords, so security is part of how the platform is built and run. Here is what protects your data and your traffic, and how to verify it.

**Short answer:** OmniChannels.ai runs on BroadNet Technologies' infrastructure, which holds ISO/IEC 27001:2022, ISO/IEC 27018, ISO 9001:2015 and ISO 22301 certifications and a SOC 2 Type II attestation, and operates in line with the GDPR. API and SMPP traffic is encrypted in transit, access uses per-account bearer tokens, and operator-grade firewalls help block SMS fraud such as artificially inflated traffic.

## How your data and traffic are protected

- **Certified information security:** BroadNet's information security management system is certified to ISO/IEC 27001:2022, with ISO/IEC 27018 for protecting personal data in the cloud.
- **Independently audited controls:** A SOC 2 Type II attestation covers how security and availability controls operate over time. The report is available to customers under NDA.
- **Encryption in transit:** The REST API is served over HTTPS and SMPP binds run over TLS, so message content and credentials are encrypted between your systems and ours.
- **Token-based access:** Each account authenticates with its own bearer token. Tokens can be rotated or revoked, and test access sends only to your own verified numbers.
- **Fraud and grey-route protection:** BroadNet operates SMS firewalls for mobile operators and routes over direct operator connections, which helps block SMS pumping and unauthorised routes.
- **Business continuity:** ISO 22301 certification covers how BroadNet plans for and recovers from disruptions, so critical traffic such as one-time passwords keeps flowing.
- **Consent and opt-out tools:** Opt-out handling, duplicate filtering and sender ID registration support help you message only people who agreed to hear from you.
- **Privacy by design:** BroadNet operates in line with the GDPR and offers a data processing agreement. Data residency questions are reviewed with you during onboarding.

## Certifications and attestations

| Item | Details |
|---|---|
| ISO/IEC 27001:2022 | Information security management system |
| ISO/IEC 27018 | Protection of personal data in public cloud services |
| ISO 9001:2015 | Quality management |
| ISO 22301 | Business continuity management |
| SOC 2 Type II | Independent attestation of security and availability controls; report under NDA |
| GDPR | Operated in line with the EU General Data Protection Regulation, with a data processing agreement |
| GSMA SAS-SM | Security accreditation for subscription management, in progress |

## How to review us

1. **Check the certificates:** Look up BroadNet's ISO certificates in the IAF CertSearch database or ask us for copies.
2. **Request the SOC 2 report:** We share the SOC 2 Type II report and security documentation under NDA.
3. **Send your questionnaire:** Our team completes security and vendor questionnaires for procurement.
4. **Agree the data processing terms:** Sign the data processing agreement and confirm data residency needs for your markets.

## 

### A good fit when

- Your procurement requires recognised certifications and an independent audit report.
- You send one-time passwords, alerts or other sensitive notifications.
- You need written data processing terms before going live.

### Good to know before you start

- Audit reports are shared under NDA, not published.
- Data residency options depend on the channel and market and are confirmed during onboarding.
- WhatsApp, RCS and other channels also process data under their own providers' terms.

## Security questions

### Which certifications does BroadNet hold?

ISO/IEC 27001:2022, ISO/IEC 27018, ISO 9001:2015 and ISO 22301, plus a SOC 2 Type II attestation. BroadNet operates in line with the GDPR, and its GSMA SAS-SM accreditation is in progress.

### Can I get the SOC 2 report?

Yes. We share the SOC 2 Type II report with customers and prospects under NDA. Contact us and we will send it with our security documentation.

### Is message traffic encrypted?

Yes. The REST API is only available over HTTPS, and SMPP binds use TLS. Credentials are per-account bearer tokens that you can rotate or revoke.

### Do you sign a data processing agreement?

Yes. BroadNet offers a data processing agreement as part of operating in line with the GDPR.

### How do you protect against SMS fraud?

BroadNet routes over direct operator connections and operates SMS firewalls for operators, which helps block grey routes and SMS pumping. We also recommend rate limits and fallback design for one-time passwords.

### How do I report a security issue?

Email security@omnichannels.ai with details. We acknowledge reports and investigate them promptly.

Updated: 2026-10-10