Here’s a high level summary of our security architecture.

1)  All of our database and application servers are 100% bare metal, hosting Omnna only. We do not share virtual servers with anyone else in the cloud. These cloud servers are dedicated to our applications and databases only. These servers reside on our own private network within the data center, and only Omnna and contract data center personnel have access to them.

2) Our web servers are limited to only encrypted https traffic from the outside world. No other ports are accessible or scannable.

3) The database servers are 100% locked down to all internet access. They do not have public facing IP addresses, and are only accessible via our private network inside our data centers. We use a two-tier architecture where the applications reside on Apache web servers, but not the data. The data is accessed by the already secure application servers via a private IP network where our secure database servers reside.

4) All web traffic is HTTPS encrypted/decrypted by the load balancers. In order to access the Omnna application servers you need to access them through the load balancers. In addition, the load balancers communicate with the servers on a non-standard “high” port number. This keeps the standard https port 443 closed on the application servers.

5) No access is allowed without a Omnna username and password. As always, the most important part of security are the human factors of keeping usernames and passwords private. No security system in the world (aside from biometric) can make up for poor password policies.

6) Additionally, we have a proprietary IP security feature that you may optionally configure. When implemented, it limits the IP addresses that any login can access your instance of Omnna from. Basically it is a “white list” that you maintain of IP addresses and who can use them. For example, you can allow the users from location A to only be able to log in from the location A IP address. This means that even with a valid username and password, they cannot access Omnna from anywhere else. Executive level access can be extended to home IPs for work from home, or even lifted to allow access from anywhere for specific people.

7) Finally, the only way we ourselves are able to access our own systems for maintenance and development is via a secure VPN tunnel to our backend private network.