OmniFlowAuthority is earned, not assumed.
Workflows touch money, data and production. OmniFlow limits what they can do by default, and records what they did.
Default-deny network
Steps reach only the hosts they declare. Private and metadata addresses are blocked unless you turn that on, and redirects are re-checked at every hop.
Secrets stay secret
Secrets are encrypted at rest, leased to one step at a time, scrubbed from logs and outputs, and never written into plans.
Four-eyes by default
Whoever requests a change cannot approve it. Approval rules can depend on risk, environment and criticality.
Roles and policy
Admin, author, operator, approver and viewer roles, plus policy documents you control. Agents may propose, never execute.
Tenant isolation
Every row carries its tenant and is filtered in the data layer. Isolation is covered by tests, not by convention.
Tamper-evident history
Audit events are hash-chained. A broken chain is detected, reported, and raised as an alert.
Risk is assessed at publish time.
Each workflow is reviewed against a set of rules before it can be published: shell use, wildcard or raw-IP egress, effectful steps with no rollback, secret-shaped values, and text that looks like instructions to an AI.
- Blocking findings stop publication until resolved.
- Production effects need a second reviewer.
- Everything is recorded with who decided and why.
Found a problem?
Report vulnerabilities through NEXORA's security contact. We acknowledge reports and keep you informed. This page describes the product's design; it is not a certification claim.