Security overview

Oddyssey runs on managed cloud infrastructure in the United States and European Union, behind a global edge network. We do not run our own hardware and we do not keep customer data on staff machines.

All traffic is served over TLS. Data at rest, including database storage, file storage and backups, is encrypted. Connection credentials for the services you link are stored in an encrypted vault and decrypted only at the moment they are used to carry out your instruction.

Every record belongs to a workspace and every query is scoped to it at the database level, not just in the interface. One customer cannot read another customer's data through the product.

• Role-based access inside your workspace, so you decide who can approve spend, publish or send.
• Staff access to production is least-privilege, individually attributed and used only to operate or support the service.
• Administrative actions are logged.

Approvals, spend authorizations, publishes and sends are recorded with who did it, when, and what changed. Agent actions are recorded the same way, with the account that authorized them.

We never see or store full card numbers. Our own subscription billing runs through Stripe. Where you connect your own gateway for your checkout, card data goes directly to that gateway, which keeps your checkout out of scope for card data on our side.

Databases are backed up continuously with point-in-time recovery. Backups are encrypted and aged out on a fixed schedule.

Changes go through review before release, dependencies are scanned for known vulnerabilities, and secrets are kept out of source code.

Email support@tryoddyssey.com with the subject "Security". Include enough detail to reproduce. We will acknowledge within two business days. Please do not run tests that degrade the service or touch other customers' data, and give us reasonable time to fix an issue before disclosing it.

We do not currently hold SOC 2 or ISO 27001 certification, and we will not imply otherwise. If your procurement needs a security questionnaire completed, send it over and we will answer it honestly.