Security and trust at OmniChannels.ai
Customer messaging carries personal data and one-time passwords, so security is part of how the platform is built and run. Here is what protects your data and your traffic, and how to verify it.
- 1Your systems
- 2TLS-encrypted API or SMPP
- 3Access token check
- 4Routing and fraud controls
- 5Operator network
- 6Customer's phone
The credentials behind the platform. Certificates can be checked in the IAF CertSearch database; audit reports are shared under NDA.
Short answer
Updated
OmniChannels.ai runs on BroadNet Technologies' infrastructure, which holds ISO/IEC 27001:2022, ISO/IEC 27018, ISO 9001:2015 and ISO 22301 certifications and a SOC 2 Type II attestation, and operates in line with the GDPR. API and SMPP traffic is encrypted in transit, access uses per-account bearer tokens, and operator-grade firewalls help block SMS fraud such as artificially inflated traffic.
How your data and traffic are protected
Certified information security
BroadNet's information security management system is certified to ISO/IEC 27001:2022, with ISO/IEC 27018 for protecting personal data in the cloud.
Independently audited controls
A SOC 2 Type II attestation covers how security and availability controls operate over time. The report is available to customers under NDA.
Encryption in transit
The REST API is served over HTTPS and SMPP binds run over TLS, so message content and credentials are encrypted between your systems and ours.
Token-based access
Each account authenticates with its own bearer token. Tokens can be rotated or revoked, and test access sends only to your own verified numbers.
Fraud and grey-route protection
BroadNet operates SMS firewalls for mobile operators and routes over direct operator connections, which helps block SMS pumping and unauthorised routes.
Business continuity
ISO 22301 certification covers how BroadNet plans for and recovers from disruptions, so critical traffic such as one-time passwords keeps flowing.
Consent and opt-out tools
Opt-out handling, duplicate filtering and sender ID registration support help you message only people who agreed to hear from you.
Privacy by design
BroadNet operates in line with the GDPR and offers a data processing agreement. Data residency questions are reviewed with you during onboarding.
Certifications and attestations
| Item | Status | Details |
|---|---|---|
| ISO/IEC 27001:2022 | Available | Information security management system |
| ISO/IEC 27018 | Available | Protection of personal data in public cloud services |
| ISO 9001:2015 | Available | Quality management |
| ISO 22301 | Available | Business continuity management |
| SOC 2 Type II | Available | Independent attestation of security and availability controls; report under NDA |
| GDPR | Available | Operated in line with the EU General Data Protection Regulation, with a data processing agreement |
| GSMA SAS-SM | Roadmap | Security accreditation for subscription management, in progress |
How to review us
- 1
Check the certificates
Look up BroadNet's ISO certificates in the IAF CertSearch database or ask us for copies.
- 2
Request the SOC 2 report
We share the SOC 2 Type II report and security documentation under NDA.
- 3
Send your questionnaire
Our team completes security and vendor questionnaires for procurement.
- 4
Agree the data processing terms
Sign the data processing agreement and confirm data residency needs for your markets.
A good fit when
- Your procurement requires recognised certifications and an independent audit report.
- You send one-time passwords, alerts or other sensitive notifications.
- You need written data processing terms before going live.
Good to know before you start
- Audit reports are shared under NDA, not published.
- Data residency options depend on the channel and market and are confirmed during onboarding.
- WhatsApp, RCS and other channels also process data under their own providers' terms.
Security questions
Which certifications does BroadNet hold?
ISO/IEC 27001:2022, ISO/IEC 27018, ISO 9001:2015 and ISO 22301, plus a SOC 2 Type II attestation. BroadNet operates in line with the GDPR, and its GSMA SAS-SM accreditation is in progress.
Can I get the SOC 2 report?
Yes. We share the SOC 2 Type II report with customers and prospects under NDA. Contact us and we will send it with our security documentation.
Is message traffic encrypted?
Yes. The REST API is only available over HTTPS, and SMPP binds use TLS. Credentials are per-account bearer tokens that you can rotate or revoke.
Do you sign a data processing agreement?
Yes. BroadNet offers a data processing agreement as part of operating in line with the GDPR.
How do you protect against SMS fraud?
BroadNet routes over direct operator connections and operates SMS firewalls for operators, which helps block grey routes and SMS pumping. We also recommend rate limits and fallback design for one-time passwords.
How do I report a security issue?
Email security@omnichannels.ai with details. We acknowledge reports and investigate them promptly.
Guides on this topic
- ComplianceWhatsApp Business API Security and Privacy: What to Know8 min read
- SMS & OTPSMS Pumping Fraud: How AIT Works and How to Stop It9 min read
Explore more of the platform
Need security documentation?
Ask for the SOC 2 report, certificates or our answers to your security questionnaire.