SOC 2 Type II — in progress
Underway, not yet certified. We will publish the report and observation period when there is one, and we will not claim it before then.
SOC 2 Type II in progress · Every change on the audit log
Bring your security review. We keep the packet ready.
Sub-processor list, DPA and our security overview — all in one envelope, delivered within 24h of request. Need a HIPAA BAA? We review it with you.
Where we stand, without rounding up.
HIPAA — reviewed with you
Tell us before you store health data. We review your use and say whether we can sign a BAA for it, and on what terms.
GDPR + DPA
A DPA with standard contractual clauses for every customer, a published sub-processor list, and hosting in the European Union.
Cards stay with the gateway
Card payments go through PCI DSS Level 1 processors such as Stripe, Adyen and Razorpay. We never receive or store card numbers or security codes.
Encryption, isolation, backup.
- Encrypted in transit
- TLS 1.2 or 1.3 on every connection, including real-time ones, with HTTP Strict Transport Security.
- Credentials encrypted at rest
- Tokens for connected accounts, and email, AI and payment provider keys, are encrypted in the database with AES-256-GCM. The rest of the database and file storage are not encrypted at the application level today; access to them is limited to administrators.
- Per-workspace isolation
- Every business record carries its workspace, every query is scoped to it, and every action checks the caller's permissions before it runs. There is no database row-level security as a second layer yet.
- Backups
- The database is backed up before every deployment, and backups are kept for 30 days. Point-in-time recovery is not offered yet.
- Hosting
- Servers we operate in the European Union, provided by Contabo GmbH. There is one region today; a choice of region is not offered yet.
- Your own storage bucket
- We can keep a workspace's files in a bucket it owns — Amazon S3, Cloudflare R2, Backblaze B2, MinIO or another S3-compatible store — set up with you. Google Cloud and Azure buckets are planned.
Who can do what, and how they prove it.
- Sign-in
- Passwords, or Google, Microsoft, GitHub or LinkedIn accounts. Single sign-on by OpenID Connect is set up with us; SAML and LDAP are not available yet.
- Passkeys and two-factor
- Passkeys, authenticator apps, hardware security keys and backup codes. An owner can require two-factor sign-in for the whole workspace, and a few of the most sensitive actions ask you to confirm it is you again.
- Roles and permissions
- Five standard roles (owner, admin, manager, employee, client), your own custom roles, and per-person grants or revocations. Roles can be limited to a person's own or their team's records.
- The AI works inside your permissions
- In the app it acts with yours, narrowed to what the AI may do, and never more. Outside tools that connect over MCP use an API key you create; it acts with your permissions and can be narrowed and given an expiry when created through the API.
- Support access is recorded
- When our support team steps into a workspace, it needs a stated reason, it expires on its own, and every change made during it records both people.
One log. Every change. Every actor.
- Every change is an audit row
- The app, the AI and the MCP server all call the same actions, and each call records who made it, its full input and its result.
- Chained daily
- A SHA-256 digest over each day's records makes a later edit to history detectable. We check the chain; it is not yet shown in your workspace.
- Export
- We can give you a CSV of your workspace's audit log on request. Streaming it to your SIEM is not available yet.
- AI attribution
- Everything the AI does is recorded against the person it acted for and marked as the AI's, so you can filter for everything the AI did last week.
- Rate limits and alerts
- Sign-in and the app's actions are rate-limited per address and per action, with an overall cap per address; calls made with API keys are not rate-limited yet. Owners see locked accounts, repeated failures and pending deletions under Settings › Access › Security.
Report it; we answer within 3 business days.
- Where to report
- support@odexy.app,
with "Security" in the subject. Our
/.well-known/security.txtlists the same contact. - What happens next
- We acknowledge your report within 3 business days and keep you informed while we investigate.
- Testing
- Internal testing runs continuously against the action layer and the AI-agent surface. Third-party penetration testing is planned rather than established — we will name the cadence and the firm once there is one to name.
- Coordinated disclosure
- We credit researchers who want credit, and do not take legal action against good-faith research. There is no paid bounty program today.
- Security fixes
- Fixes that affect you are announced in the changelog and the "What's new" email.
Every third party we send data to.
- Sub-processor list
- Every third party Odexy sends customer data to, with at least 30 days' notice before one is added or replaced, announced in the changelog.
- Data Processing Agreement
- Standard contractual clauses; it applies automatically when you accept the Terms, and a countersigned copy is available.
- Privacy policy
- How to access, correct, export or delete your data. Account deletion is self-service in your security settings.
- Compliance
- Where we stand on SOC 2, ISO 27001, HIPAA and GDPR.
- Trust page
- A summary for external buyers, with links to the status page and its incident history.
Bring your security packet request.
Everything a security-review team asks for — kept current, delivered within 24h of request.