Omniposter › Security & Compliance
Built for buyers who can't afford a surprise.
Advisors, attorneys, doctors. The version of "AI marketing" that doesn't end with a regulator's letter on your desk. Here is exactly what we do, how we do it, and what we explicitly don't do.
Voice fidelity
Nothing publishes without your approval.
Editorial approval is built into the pipeline — not a setting you can disable. Every AI-generated draft, blog and social, lands in your queue. You review, you edit if needed, you approve. The platform connectors will not ship content that hasn't been signed off by a human in your account.
This is not "compliance theater" — it's how the product actually works. Look at the editorial queue, look at the workflow states, look at the publishing surfaces. There's no toggle for autopilot. Pitches → you pick → AI drafts → you approve → we schedule. That's it.
Voice fingerprinting runs on your own archive. Reporter personas are tuned on your existing writing — not on the internet's average voice. When the AI drifts (which it sometimes does), the queue catches it; you catch it.
Credentials & data
What we hold. What we don't.
WordPress Application Passwords
No plugin to install (nothing to maintain, nothing to get exploited). Application Passwords are built into WordPress 5.6+ and revocable from your admin at any time. Scoped to the API operations we actually need.
OAuth for socials, with refresh handling
LinkedIn, X, Instagram, and Facebook connect via the platforms' standard OAuth flows. Access tokens are encrypted at rest. We refresh proactively before expiry; we never ask for your platform password.
Three-LLM editorial engine, your data stays here
The pipeline routes across Claude, GPT, and Gemini for resilience. Your content goes through the providers' standard APIs and is not used to train their models (per their published terms for paid API traffic). Your archive and reporter voices live in our database.
Analytics access is read-only
Google Analytics and Search Console connections are scoped to read-only. We pull aggregated reports for the weekly trendline brief; we do not modify your GA/GSC configuration or export raw user-level data.
By your regulator
Where each vertical lands.
Independent advisors (SEC / state-registered RIAs)
The SEC's marketing rule (Rule 206(4)-1) treats algorithmically-generated communications as advertisements when distributed by an investment adviser. Omniposter's mandatory editorial approval is the gate that keeps you in the rule's framework: you, the human investment professional, are the one approving every communication before it goes out. The voice fingerprint prevents the AI from drifting into territory your CCO would flag. Records retention follows your platform's defaults — nothing exotic for a routine examination. See the advisor page for more ›
Boutique attorneys
Attorney advertising rules vary by state but most prohibit (a) outcome guarantees, (b) misleading impressions of expertise, and (c) UPL. Voice fingerprinting trained on your existing posts keeps generated copy in your established register; editorial approval catches anything that drifts toward an outcome promise; we don't claim or mention specific client matters unless you write them in. The reporter personas system lets you keep distinct partner / associate bylines from a single editorial queue. See the attorneys page ›
Medical practices
Omniposter is not a HIPAA business associate. PHI should not appear in your blog or social posts — you wouldn't put it there anyway. Voice fingerprinting keeps your tone clinical-but-warm; editorial approval catches anything that reads as off-label or as a guaranteed outcome. For state medical-board advertising rules, the same approval gate applies: a licensed clinician (you) is the one approving every patient-facing communication. See the medical page ›
Real estate
Fair Housing-aware copy with your voice fingerprint preventing AI from drifting into protected-class language. WordPress connections coexist with your IDX plugin without conflicts. Editorial approval gives you a final pass before anything that mentions a listing or a neighborhood goes live. See the real estate page ›
What we explicitly don't claim
The honest list.
We'd rather you trust us in year three than oversell on day one. Some things buyers reasonably ask about that we are not claiming today:
- SOC 2. Not certified. On the roadmap; not today.
- HIPAA BAA. Not offered. We are not a covered entity or business associate.
- Enterprise SSO. Not yet — standard email/password and per-user accounts today.
- Fully autonomous publishing. Not a feature, by design. Editorial approval is mandatory.
- Pre-built compliance archive for FINRA/SEC. We retain your records on our platform; if you need a specific FINRA-compliant archive vendor integrated, talk to us before signing up.
Reporting a vulnerability
Found something? Tell us.
Security reports come straight to the founding team. We respond within one business day to anything that affects credential security, data isolation, or unauthorized publishing. Public disclosure: we'll coordinate timing with you and credit you in the changelog if you'd like.
Start your free trial.
14 days free, card required. Live in under 30 minutes if you have your credentials handy.
Start your free trial →$299/mo · 14-day free trial · card required · cancel anytime