Who owns business records?
Your organization retains ownership of the information, documents, communications and records it uploads or creates. OmniVentis receives a limited license to operate and secure the requested service.
SECURITY, TRUST & CONTROL
Connected work. Deliberate boundaries.
QuotaPartner is built so your team decides who sees what and what Gnoveris is allowed to prepare or perform. These are the controls that are live today—and the limits that still apply.
YOUR DATA
Direct answers about ownership, portability and AI use.
Can we export data?
Authorized exports are available for selected Revenue, Construction, Workforce, Business OS, accounting and tax-readiness records. Formats and scope vary by workflow. A universal self-service export is not currently available.
Can we request deletion?
Privacy requests can be submitted through Support. We verify the requester and apply legal, security, contractual, audit and record-retention requirements. We do not publish a fixed deletion deadline.
How long is data retained?
Retention depends on the record, enabled service, organizational instructions and legal requirements. Some operational and audit history must remain available for security, disputes and required records.
Is business data used to train generalized AI models?
Gnoveris processes authorized information to provide requested features. QuotaPartner's current data-use controls do not authorize generalized model training by default, and implemented OpenAI requests disable provider response storage. SMS opt-in data and consent are never used for generalized model training.
WHO CAN SEE WHAT
Access follows the signed-in person and selected workspace.
Organization and workspace separation
Authenticated requests derive organization membership on the server. Workspace and record access are checked again at protected services.
Roles and permissions
Owners, admins, managers, members and other supported roles receive different permitted actions. A connected workflow does not grant access to every record.
MFA and sessions
QuotaPartner supports passkeys and authenticator-app codes. Enrolled users must satisfy MFA for protected sessions. Database sessions use secure cookies, idle and absolute expiration, revocation and disabled-account checks.
Connected services
An eligible user must authorize each supported provider. Connections can be disconnected, and provider-side revocation remains available. Provider authorization does not grant Gnoveris broader business authority.
WHAT GNOVERIS CAN DO
Approval is separate from completion.
Gnoveris can explain, recommend and prepare supported work. A limited set of native actions can enter an exact approval flow with a separate Perform step. The application records what was proposed, approved, attempted and verified without treating one state as another.
LIVE PILOT CONTROLS
Specific safeguards operating today.
Scoped access
Server-side organization, workspace, role and entitlement checks limit access to business records.
Approval-bound actions
Supported supervised actions bind the exact proposal, underlying records, policy and approver before a separate Perform step.
Result evidence
Action history separates preparation, approval, attempt and verified result. A queued job or provider response is not presented as completion.
Pause and takeover
Owners can keep controls Off, pause supported execution, reject or cancel proposals, and continue through normal manual workflows.
Provider safeguards
Connected services require eligible authorization. Stored provider credentials are encrypted on the server and scoped to the correct organization.
WHERE WE ARE TODAY
QuotaPartner is in pilot.
SOC 2 and ISO 27001 certifications are not complete. We do not make a universal compliance claim. Formal certification, broader customer-facing automation and expanded self-service portability remain future work and are not presented as live controls.
IF SOMETHING GOES WRONG
Report the issue without sending sensitive credentials.
Use authenticated Support when available so the correct organization and record context can be checked. If you cannot sign in, email support@omniventissystems.com. Do not send passwords, MFA codes, access tokens or private customer records by email.
We classify, contain, investigate and preserve evidence for incidents. Affected customers are notified as required by applicable law, contract and the incident’s verified impact. No fixed public notification deadline is promised.