Omniposter › Security & Compliance
Built for buyers who can't afford a surprise.
Advisors, attorneys, doctors. The version of "AI marketing" that doesn't end with a regulator's letter on your desk. Here is exactly what we do, how we do it, and what we explicitly don't do.
Voice fidelity
You decide what it takes to publish.
Every AI-generated draft — blog and social — goes through editorial review before it ships. By default that reviewer is you: drafts land in your approval queue, you review and edit, you approve. For regulated practices, leave the project on manual and a licensed human (you) signs off on every communication that goes out. There is no publish-by-surprise.
If you want leverage instead of a queue, you can opt a project into auto mode: an AI editor reviews each draft against the standards you write, sends weak ones back to rewrite, and approves the rest — with a full audit trail of what it saw and decided. Auto is off by default and you turn it on per project; manual is always available.
Either way, voice matching runs on your own archive — writer personas are tuned on your existing writing, not the internet's average voice — so what's reviewed already sounds like you.
Credentials & data
What we hold. What we don't.
WordPress Application Passwords
No plugin to install (nothing to maintain, nothing to get exploited). Application Passwords are built into WordPress 5.6+ and revocable from your admin at any time. Scoped to the API operations we actually need.
OAuth for socials, with refresh handling
LinkedIn, X, Instagram, and Facebook connect via the platforms' standard OAuth flows. Access tokens are encrypted at rest. We refresh proactively before expiry; we never ask for your platform password.
Three-LLM writing engine, your data stays here
The pipeline routes across Claude, GPT, and Gemini for resilience. Your content goes through the providers' standard APIs and is not used to train their models (per their published terms for paid API traffic). Your archive and writer voices live in our database.
Analytics access is read-only
Google Analytics and Search Console connections are scoped to read-only. We pull aggregated reports for the weekly trendline brief; we do not modify your GA/GSC configuration or export raw user-level data.
The in-app assistant is read-only and walled off
Ask Omni answers questions and surfaces your own stats — it can't change settings, publish, or touch credentials, and it's scoped to your account. Like the writing engine, it runs on the providers' standard paid APIs, so those conversations aren't used to train their models (per their published terms).
By your regulator
Where each vertical lands.
Independent advisors (SEC / state-registered RIAs)
The SEC's marketing rule (Rule 206(4)-1) treats algorithmically-generated communications as advertisements when distributed by an investment adviser. Keep the project on manual and Omniposter's human-approval gate keeps you in the rule's framework: you, the human investment professional, approve every communication before it goes out. The voice matching prevents the AI from drifting into territory your CCO would flag. Records retention follows your platform's defaults — nothing exotic for a routine examination. See the advisor page for more ›
Boutique attorneys
Attorney advertising rules vary by state but most prohibit (a) outcome guarantees, (b) misleading impressions of expertise, and (c) UPL. Voice matching trained on your existing posts keeps generated copy in your established register; keep the project on manual and your review catches anything that drifts toward an outcome promise before it ships; we don't claim or mention specific client matters unless you write them in. The writer personas system lets you keep distinct partner / associate bylines from a single editorial queue. See the attorneys page ›
Medical practices
Omniposter is not a HIPAA business associate. PHI should not appear in your blog or social posts — you wouldn't put it there anyway. Voice matching keeps your tone clinical-but-warm; editorial approval catches anything that reads as off-label or as a guaranteed outcome. For state medical-board advertising rules, keep the project on manual so a licensed clinician (you) approves every patient-facing communication. See the medical page ›
Real estate
Fair Housing-aware copy with voice matching preventing AI from drifting into protected-class language. WordPress connections coexist with your IDX plugin without conflicts. Editorial approval gives you a final pass before anything that mentions a listing or a neighborhood goes live. See the real estate page ›
What we explicitly don't claim
The honest list.
We'd rather you trust us in year three than oversell on day one. Some things buyers reasonably ask about that we are not claiming today:
- SOC 2. Not certified. On the roadmap; not today.
- HIPAA BAA. Not offered. We are not a covered entity or business associate.
- Enterprise SSO. Not yet — standard email/password and per-user accounts today.
- Hands-off publishing with zero oversight. Auto mode exists, but it's an opt-in AI editor that enforces the standards you write and keeps a full audit trail — not a fire-and-forget firehose. Human approval (manual mode) is always available and is what we recommend for regulated practices.
- Pre-built compliance archive for FINRA/SEC. We retain your records on our platform; if you need a specific FINRA-compliant archive vendor integrated, talk to us before signing up.
Reporting a vulnerability
Found something? Tell us.
Security reports come straight to the founding team. We respond within one business day to anything that affects credential security, data isolation, or unauthorized publishing. Public disclosure: we'll coordinate timing with you and credit you in the changelog if you'd like.
Start your free trial.
14 days free, card required. Live in under 30 minutes if you have your credentials handy.
Start your free trial →$299/mo · 14-day free trial · card required · cancel anytime