OMSCAN.AI

Security

An offering memorandum is confidential. This page says how OMSCAN handles one: what is kept, who can see it, and when it is gone. It describes what the service does today; the Privacy Policy and the Terms govern.

Your OM is not stored

When you scan a document, its page text and page images are sent for reading and the structured result comes back to you. The file itself is not kept. What is kept, under your account, is what the read produced: the figures, the page each came from with a short quote of the line it was read from, and how any difference between the two readers was settled. The one exception is a document you choose to attach to a report about a read, which is kept with that report so it can be checked.

A rent roll, T-12 or spreadsheet you paste or type is read in your browser and never uploaded.

Only you can see your deals

• Access is enforced by the database itself. Every table that holds deal or read data is restricted so a signed-in account can reach only its own rows. One customer cannot read another’s deals, reads or results.
• Reads are never shared between customers. If two customers scan the same OM, each read is separate. An earlier read is reused only for the same account that made it.
• Sharing is yours to decide. A deal is seen by someone else only if you share it with them, and you can withdraw the share.
• Our own access is limited. The operator’s console shows account information (an email address, a plan, counts of deals and reads) to run the business and handle support. It does not show the contents of your deals or your reads.

Who reads the document

Two AI processors read the pages: a primary reader, and an independent reader that checks it. They are named in the Privacy Policy. Both receive the document under business terms that do not allow them to train their models on it. The independent reader’s copy of each request is deleted from that provider as soon as its answer is saved; each provider may hold what it received for a limited period for abuse and safety monitoring, under its own policy. The document goes to nothing else: no analytics, no advertising, no third party.

Card payments are taken by Stripe. No card number reaches this site.

Deletion is automatic

• One-time scans. A deal bought with a one-time scan is deleted 30 days after its scan completes, with its versions and scenarios, unless you keep it with OM | SCAN+. You are emailed 14 days and 3 days before.
• Ended subscriptions. When a subscription ends, its deals are archived for 30 days and then deleted unless the subscription is restarted.
• On request, at once. Delete account in My Deals deletes the account and its deals, versions, reads and share links at once; if anything interrupts it, the daily deletion finishes it.

Deletion runs on a daily schedule; nobody has to remember to do it. Database backups expire on their own schedule after a deletion.

How the service is built

• All traffic is encrypted in transit (HTTPS only, enforced in the browser with HSTS). The site cannot be placed inside another site’s frame.
• Stored data is held by our database provider, encrypted at rest.
• Service keys for the readers and for payments live only on the server. None is ever sent to a browser.
• Sign-in is by email or Google. Passwords, where used, are stored only as a hash by our authentication provider.

What we do not claim

OMSCAN.AI does not yet hold a third-party certification such as SOC 2. No system is perfectly secure, and we do not claim otherwise. If your firm runs a security review, write to contact@omscan.ai and we will answer your questionnaire directly.

Questions: contact@omscan.ai  ·  Privacy  ·  Terms  ·  Back to the model