Compliance is a product decision, not a policy.
The controls below are what the platform enforces or exposes to app owners. This page is not an independent certification — it describes capabilities, not audit outcomes.
EU data residency
EU by default. Message media and portal uploads stay in the EU.
Row-level security
Every table scoped by tenant, brand and role. Break-glass access uses a separate path with reason, expiry and review.
WhatsApp Cloud API only
Official Business Platform route via Meta or an authorised BSP. No unofficial scraping.
DSGVO subject rights
Export, rectification and erasure workflows for controllers, with per-purpose retention classes.
Consent & purpose
Purpose-scoped consent, frequency caps, opt-out synchronised across channels and campaigns.
Audit trail
Every send, view, decision and AI action is logged with actor, timestamp, purpose and retention.
Data classification
| Class | Examples | Default handling |
|---|---|---|
| Public | Marketing copy, templates | Standard storage |
| Business | Contacts, cases, invoices | RLS + audit |
| Sensitive | IDs, insurance, health | Secure portal only, short retention |
| Regulated | § 203 StGB material | Encrypted, role-gated, break-glass required |
German specifics
- TTDSG. Consent UX and cookie posture aligned to § 25 TTDSG.
- § 203 StGB. Regulated professions get a hardened preset that keeps sensitive content out of the chat body.
- DPA. Standard Auftragsverarbeitungsvertrag with subprocessor list, on request in German.
- Public sector. DACH-only residency, questionnaire support and dedicated CS on Scale/Enterprise.
This page is maintained by OmniQora to answer common questions about OmniQora. It is app-owned editable content — not an independent certification.