Incident response
How we detect, contain, and disclose security incidents — and the promise we make about telling you.
Detection
We aggregate security-relevant events and alert on anomalies — unusual access patterns, authentication spikes, or infrastructure errors.
Containment
On confirmation of an incident, we isolate affected systems, revoke suspect credentials, and preserve evidence for analysis.
Disclosure
If an incident affects your data, we notify affected customers without undue delay — including what we know, what we don't, and what you should do. We will not sit on bad news.
Reporting a vulnerability
Email security@omegavault.app. For sensitive reports, encrypt to our PGP key. We acknowledge within 48 hours.
What we will not do
- Quietly fix a data-impacting issue and not tell affected users.
- Require an NDA simply to report a bug (we may ask for one only when coordinating public disclosure of a sensitive finding).