Skip to main content

​
User access control

Omneo uses role-based access control. Only grant users the role they need: Review user access quarterly. Remove accounts for staff who have left the organisation.

​
API token management

  • Generate separate API tokens for each integration rather than using one shared token
  • Use the minimum required scopes for each token
  • Store tokens securely: never in source code, public repositories, or unencrypted files
  • Rotate tokens when staff who had access leave, or when a security incident is suspected
  • Machine user accounts should use strong, randomly generated passwords (32+ characters)

​
IP allowlisting

For Clienteling access from POS terminals, Omneo maintains a per-tenant IP allowlist. Only known IP addresses can access the Clienteling portal. Contact Omneo support to update your allowlist when:
  • Adding new store locations
  • Changing network infrastructure
  • Enabling remote access (e.g., mobile POS)

​
Data handling

  • Omneo stores personally identifiable information (PII) in accordance with Australian privacy law
  • For GDPR-compliant erasure of a customer’s data, use the Purge endpoint rather than the standard delete
  • Do not export bulk customer data to unsecured locations
  • Tag profiles that should be handled with care (e.g., "handle-with-care") to alert customer service staff

​
Shared secrets

Omneo uses shared secrets for service authentication, for example the barcode service token and extension webhook secrets. These should be:
  • Stored in environment variables or a secrets manager: never hardcoded
  • Rotated regularly
  • Never shared in plain text via email or chat
Content needed: Omneo’s data residency and compliance certifications (ISO 27001, SOC 2, etc.), specific GDPR/APPs compliance features, and pen testing procedures.