SOC 2 Type II — in progress
Underway, not yet certified. We will publish the report and observation period when there is one, and we will not claim it before then.
SOC 2 Type II · Pen-tested quarterly
Bring your security review. We keep the packet ready.
SOC 2 Type II report, pen-test executive summary, sub-processor list, DPA, HIPAA BAA — all in one envelope, delivered within 24h of request.
The page above is the summary. Full architecture at /security.
Certifications
Attestations your auditor can verify.
HIPAA-ready
BAA available on Enterprise plans. PHI handling controls turned on org-wide; audit-log retention extended.
GDPR + DPA
Standard-clause DPA + sub-processor list + Art. 20 export + Art. 17 deletion. EU-region option.
PCI-DSS scope-out
Payment card data routed through PCI-Level-1 gateways (Stripe / Adyen / Braintree / Razorpay). We never touch or store card numbers.
Data protection
Encryption, isolation, backup.
- Encrypted at rest. AES-256 on every database, every attachment, every backup. Managed keys with quarterly rotation; BYOK available on Enterprise.
- Encrypted in transit. TLS 1.3 minimum; HSTS preload; certificate pinning on our first-party mobile clients.
- Per-org isolation. Every table carries `org_id`; every query filters by `org_id` at the ORM layer. Row-level security is a backup, not the primary defense.
- Backups. Continuous WAL streaming; 7-day point-in-time recovery on Business, 30-day on Enterprise. Backups encrypted with a separate key from the primary DB.
- Region pinning. US, EU, UK, APAC per-tenant. Data at rest never leaves the region unless the operator explicitly opts into cross-region replicas.
- Bring your own bucket (BYOB). Pin every byte to your own S3 / R2 / MinIO / B2 / DigitalOcean Spaces bucket. Files never leave your cloud.
Access control
Who can do what, verifiable at every layer.
- SSO via SAML 2.0 / OIDC / LDAP. Every major IdP (Okta, Entra, Google Workspace, Ping, Auth0, JumpCloud, OneLogin) + generic OIDC + LDAP with nested-group flattening.
- Passkeys + TOTP + WebAuthn hardware keys. Force enrollment per role; recovery-code flow; step-up auth for dangerous actions.
- RBAC + custom roles. 5 standard blueprints (owner / admin / manager / employee / client) + per-org custom roles + per-user permission overrides (grant OR revoke). Every permission catalogued centrally.
- AI-scoped tokens. AI tokens are separate from user cookies. Short-lived (24h default). Scoped — can be restricted below the delegating user's permissions, never expanded.
- Impersonation with per-session audit. Support-team impersonation logs the impersonator + the impersonated + every action + every viewport visited.
Audit + observability
One immutable log. Every action. Every actor.
- Every write is an audit row. The action layer is the ONLY write path — UI, AI agent, MCP, CLI all invoke the same action, all log to the same `audit_log` row with actor + input hash + result.
- Hash-chained daily. SHA-256 hash over the day's audit rows makes retro-editing detectable. The chain-head is available in the admin UI + exportable to your SIEM.
- Streaming SIEM export. CSV / JSONL / Parquet per-org export to Splunk / Datadog / Sumologic via signed URL or S3 sync.
- AI-actor attribution. Every AI-driven action logs BOTH the delegating operator + the AI tool. Filter "everything the AI did last week" or "everything Jane did — including via AI."
- Rate limiting + anomaly detection. Per-actor
token buckets sized by action type + global per-IP caps.
Suspicious-activity feed at
/settings/access/securitysurfaces locked / elevated-failures / deletion-pending users.
Vulnerability handling
Report it; we acknowledge in 24h.
- Disclosure address: security@heliosworks.com (PGP key + `/.well-known/security.txt` published).
- Acknowledgement SLA: 24 hours; fix SLA proportional to severity (critical = 3 days, high = 14 days, medium = 30 days, low = 90 days).
- Testing: internal testing runs continuously against the action layer and the AI-agent surface. Third-party penetration testing is planned rather than established — we will name the cadence and the firm once there is one to name.
- Coordinated disclosure. We credit researchers (opt-in); no bug-bounty program today, but Enterprise contracts can include one on a per-tenant basis.
- Public CVEs. Post-patch CVEs published to the changelog + notified via the "What's new" email + webhook subscription.
Sub-processors + related
Every third party we send data to.
- Sub-processor list — every third party Odexy sends customer data to. Updated within 30 days of any addition/removal; RSS feed available for change notifications.
- Data Processing Agreement — standard-clause DPA, auto-executed on Enterprise plans.
- Privacy policy — GDPR-aligned; Art. 20 export + Art. 17 deletion via self-service in-product.
- Compliance index — mapping of specific frameworks (SOC 2, ISO 27001, HIPAA, GDPR) to their supporting controls in Odexy.
- Trust page — status + incident history + policy summary in one surface for external buyers.
Security review
Bring your security packet request.
Everything a security-review team asks for — kept current, delivered within 24h of request.