What we have, what we do not, and how to check.
This page is for whoever has to approve us. Each answer comes from a setting, a record or the code that enforces it, and links to the page where you can verify it. Where we do not have something, we say so here rather than leave you to find out.
The questions on every vendor form
| Question | Answer | Detail | Check it |
|---|---|---|---|
| Facilities we own | Yes | Rajkot | /datacenters |
| Facilities operated by someone else | Yes | Frankfurt (Hetzner), Helsinki (Hetzner), Ahmedabad (WebWerks), Mumbai (WebWerks) | /datacenters |
| Countries your data can be held in | Yes | Germany, Finland, India Your service page names the facility your service runs in. | /datacenters |
| Written uptime commitment | No | Not committed | /sla |
| Staffed support hours | Not published | Not published | /sla |
| Backup policy | No | None published — keep your own copies | /features |
| Security certifications (ISO 27001, SOC 2, PCI DSS) | No | None held | — |
| Encryption of your server's disks by us | No | No — configure it on the service if you need it | /privacy |
| Encryption in transit | Yes | TLS on this site and the client portal, with HSTS | — |
| Trackers, analytics or advertising pixels on this site | No | None. Two functional cookies: session and CSRF token | /privacy |
| Data protection officer | No | None. Data requests reach the people who run the company | /privacy |
| GSTIN | Not published | Not published | /about |
| Public status page | Yes | Live. Last public incident 08 Oct 2026 | /status |
Controls, described as they are configured
No adjectives. If a control is partial, the description says which part.
Client portal sign-in
Five wrong passwords lock the account for 15 minutes, and sign-in requests are rate-limited per address. One-time codes are sent by WhatsApp or email, expire after five minutes, and are stored hashed, never as the code itself.
Staff accounts
Two-factor authentication is available to every staff account, and a new device must pass a one-time-code challenge before it is trusted.
Passwords and stored credentials
Passwords are stored as hashes. Credentials the platform holds for other systems, such as server keys and mailbox passwords, are encrypted at rest with the application key.
Browser protections
Every page is sent with framing, MIME-sniffing, referrer and permissions headers. The content security policy runs in report-only mode: violations are logged, not yet blocked.
Requests the server makes for you
Uptime monitors and URL tests refuse private, loopback and reserved addresses, and check every redirect, so no account can make our servers reach internal services.
Blocking an attacker on your site
From the client portal you can block an address or range on your own hosting account. It refuses private ranges, ranges wider than a /16, Cloudflare's addresses, the server's own address and yours, so a mistake cannot lock everyone out.
Your sites on our platform
Custom scripts on a customer storefront run in a sandbox with no access to this domain's cookies or session.
Real visitor addresses
Only Cloudflare's published ranges are trusted to report a visitor's address, so rate limits and blocks apply to the real client and never to a whole Cloudflare location.
What we do not have
If your policy requires any of these, we are not the right supplier for that workload yet, and it is better you learn it here than in an audit.
- No ISO 27001, SOC 2 or PCI DSS certification. We will not fill a questionnaire as if we had one.
- No encryption of your server's disks unless you set it up.
- No published backup policy. Treat every service as unbacked-up until one is.
- No uptime percentage is committed in the service level agreement.
- No published staffed support hours.
- No passkey or hardware-key sign-in for the client portal yet.
- The content security policy is not yet enforced.
- No bug bounty. Reports are welcome, and are answered by the people who run the company.
- No data protection officer.
Who else touches your data
Each gets only what it needs to do its job. Facility operators are named from the same records as the datacentres page.
| Who | What they do with it |
|---|---|
| Hetzner | Operates the building our hardware sits in: Frankfurt, Germany; Helsinki, Finland |
| WebWerks | Operates the building our hardware sits in: Ahmedabad, India; Mumbai, India |
| Cloudflare | Sits in front of this website; sees visitors' addresses and requests |
| Payment providers | Take card and online payments; we receive only the result and a reference |
| Email and messaging providers | Deliver invoices, notices and one-time codes by email and WhatsApp |
The full account of what we collect, why and for how long is in the privacy policy.
Report a vulnerability
Write to sales@omlinux.in. Include the address or page affected, what you did, what you saw, and how to reproduce it. A report reaches the people who run the platform, not a queue.
Please do not read, change or delete data that is not yours, do not test by degrading the service for others, and give us a reasonable chance to fix the issue before you publish it.
Built for procurement, not just checkout
If a purchase order, a vendor form or an audit sits between you and the order button, this is what you will be asked for — and where to find it.
- A written service level agreement, with the credit you get if we miss it
- Every site named with its operator, power, cooling and carriers
- The renewal price is the list price, for every plan
- You choose whether your data stays in India or sits in Europe
- What we hold, what we do not, and who else touches your data
- Quotations for anything not on the price list
Need a signed document, not a web page?
Annual contracts, invoice billing and named contacts are on the enterprise page. Ask for anything your review needs and we will tell you whether we can provide it.