Access has a workspace context.
Tenant-aware authorization checks the organization and workspace context of an action. A connected account is not a shared global resource for every signed-in user.
SECURITY & TRUST
Good connections
need clear boundaries.
Security is part of how Omqelo connects accounts, scopes access and handles provider data. Here are the practices implemented in the current architecture.
Credentials stay server-side.
Provider credentials are handled on the server and stored encrypted. Provider secrets are not part of the browser’s public configuration.
Ownership is protected independently.
Canonical account ownership uses a keyed fingerprint of the exact provider identity. This helps enforce ownership boundaries without relying on a user-editable account label.
Permissions follow the product scope.
The requested Instagram permissions are limited to Professional account information and business messaging. We do not request content-publishing or comment-management capabilities for this scope.
Disconnect and deletion have different jobs.
Disconnecting removes provider credentials, while account ownership and historical records can remain. Deletion requests require their own verification and handling process.
Events are checked before receipt.
The Instagram webhook endpoint verifies signatures over the raw request body before accepting event processing. The receipt architecture includes deduplication and authorization-generation attribution.
These are architecture practices, not a claim of independent certification or an assurance that every risk is eliminated. Omqelo does not claim SOC 2, ISO 27001 or other formal certification.
RESPONSIBLE REPORTING
Help protect the workspace.
Do not include access tokens, account credentials, customer messages or other sensitive data in an initial security report.
Read our Privacy Policy and data deletion instructions for data-handling details.