Compliance and certifications

We publish where we stand, including what we have not done yet. We do not claim a certification we do not hold.

Summary

Framework	Where we stand
GDPR and UK GDPR	We act as a processor for our customers under our Data Processing Agreement, which includes the EU Standard Contractual Clauses and the UK Addendum. We publish our sub-processors and give 30 days’ notice of changes.
US state privacy laws (including the CCPA)	We act as a service provider to our customers. We do not sell or share personal data or use it for targeted advertising.
SOC 2	Not audited. We do not hold a SOC 2 report.
ISO 27001	Not certified.
HIPAA	Not HIPAA compliant by default. Do not store protected health information without a signed Business Associate Agreement. See HIPAA.
PCI DSS	Card payments are handled entirely by our payment processors; card numbers never reach our servers.

Roles. Our customers are controllers of the data in their workspaces; we are their processor. We are the controller for our own account, billing and website data. Our Privacy Policy explains both.
Data Processing Agreement. Part of our Terms and applies automatically; no signature needed. It covers Article 28 obligations, international transfers and breach notification.
Data subject rights. Customers can view, correct, export and delete records in their workspace, and we help with requests we cannot handle in the product. See Privacy Policy, section 12.
Hosting. Our production systems are hosted in the European Union.
Representative and officer. We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR. You can reach us directly at support@odexy.app, and we respond to requests from those regions on the same terms. We have not designated a Data Protection Officer. Privacy questions and requests are handled directly by our team at support@odexy.app.

US state privacy laws

We process personal data for our customers as a service provider, under the terms in section 13 of our DPA. As a controller, we do not sell or share personal data and do not use it for targeted advertising or profiling, so there is nothing to opt out of; the rights you do have, and how to appeal a decision, are in our Privacy Policy.

SOC 2 and ISO 27001

We have not completed a SOC 2 or ISO 27001 audit. The security measures we have in place today are described on our Security page. If your procurement process needs a security questionnaire completed, write to support@odexy.app.

HIPAA

Odexy is not a HIPAA-compliant service by default. See HIPAA for the stricter sign-in settings available and for how to discuss a Business Associate Agreement.

PCI DSS

Cards are entered into our payment processors’ own secure payment forms, so card numbers and security codes never pass through or rest on our systems. We receive only the card brand, the last four digits and the expiry date.

Contact