SOC 2 Type II — in progress
Underway, not yet certified. Our policy library is available to Enterprise customers today; the auditor's report follows when the audit does.
Passkeys · HIPAA mode · EU-hosted
The platform your security review can approve.
Google Workspace and Microsoft 365 sign-in, passkeys, two-factor. HIPAA mode. An audit log with the full input and output of every change. Hosted in the EU. A 99.95% uptime SLA on Enterprise. All of it on top of the same product your operators already use — no separate admin console, no different data model, no bolted-on chatbot.
Identity + sign-in
Google Workspace and Microsoft 365 accounts sign in directly, with passkeys and two-factor. SAML and LDAP are coming soon.
Compliance
HIPAA mode for stricter sign-in. Hosted in the EU. Sub-processor list + DPA published, and every claim on the compliance page is one we can show you.
Audit + observability
One log across every module, with the full input and output of each change, chained daily so an edit to history is detectable. The AI's actions are recorded against the person it acted for.
Sign your team in with the accounts they already have.
Google Workspace and Microsoft 365. Work accounts sign in directly, with Google one-tap where the browser supports it. GitHub and LinkedIn work too.
Passkeys and two-factor. Hardware security keys work as passkeys; authenticator-app codes come with recovery codes. An admin can require two-factor for everyone in the workspace.
SAML 2.0 and LDAP / Active Directory — coming soon. Both are part of Enterprise and are built, but cannot be switched on yet. Ask us for the date.
Our access, on the record. When our staff act inside your workspace to help you, it needs a stated reason, ends on its own, and every action records who really did it.
What your legal team can rely on today.
HIPAA mode
A stricter sign-in policy for regulated data. Before you store health information, ask us — we will tell you whether we can sign a BAA for your use, and on what terms.
GDPR and DPA
A published DPA and sub-processor list. Hosted in the EU. People can export their own data, and we delete on request.
Card payments
Card details go straight from the browser to the payment gateway — Stripe, Adyen, PayPal, Razorpay and others. Card numbers never reach our servers.
Every change, every actor — one tamper-evident log.
- One write path. The web app, the AI, MCP and the API all call the same actions, so every change lands in the same log — with its full input and output, and refused attempts too.
- Chained daily. Each day's rows are hashed onto the day before, so editing a past row is detectable. Today only we can run that check.
- The AI, attributed. Everything the AI does is recorded as the AI, against the person it acted for. Filter the log to the AI to see all of it.
- Our access, attributed. When our staff act inside your workspace, every action records both them and the account they acted as.
- Export. On Scale and Enterprise, we export your log as CSV — who did what, and when. There is no streaming feed to a SIEM yet.
Where it runs, and what Enterprise includes.
- Hosted in the EU. One region today; there is no choice of region yet.
- Your own storage bucket. We can store your workspace's files in a bucket you own — Amazon S3, Cloudflare R2, Backblaze B2, MinIO or any other S3-compatible store.
- Custom domains. Run Odexy on your own address, and give the portal your clients use an address of its own.
- 99.95% uptime SLA on Enterprise, with dedicated support and help with onboarding.
- Where it runs. We run it for you: there is nothing to install, host or upgrade.
The questions your buying committee will ask.
- Do you support SAML for our identity provider?
- Not yet. SAML and LDAP sign-in are built but cannot be switched on today. Google Workspace and Microsoft 365 accounts sign in now.
- Can we get a security-review packet?
- Yes. The sub-processor list and DPA are published, and we will answer your security questionnaire against what the product does today. SOC 2 Type II is in progress; we will add the report when the audit completes rather than before.
- Do you handle procurement paperwork?
- Yes — send us your MSA, redlines and vendor forms.
- How is Enterprise priced?
- Per organization, not per seat, like every plan — quoted for the size of your team. Every module is included. See every plan.
- How long does onboarding take?
- Your workspace is ready the day you sign up. Enterprise includes onboarding help.
Enterprise
Bring your compliance review.
Send us your security questionnaire. We will answer it against what the product does today.