Security & Customer Control

Encryption in transit (HTTPS/TLS) and encryption at rest by our database and hosting providers.

Customer-controlled deployment: the customer's IT or administration holds the credentials, keys and secrets for its workspace. We never ask for them in email or chat, and do not keep a copy.

Allowlist-only sign-in with a single accountable Head Admin per workspace; role-based permissions enforced on the server for every action.

Approval links are bound to a single purchase order and are not a login.

Secrets are meant to be stored in the customer's hosting provider's encrypted environment settings, never in source code; our setup guide explains how.

Our access to a customer deployment is none by default; any support access is granted by the customer's administrator, scoped, time-limited and revocable by them.

Complete lifecycle timestamps for every order create an audit trail of who requested, approved and ordered what.

A workspace is built on standard third-party services that the customer's IT signs up for and controls under its own agreements with those providers. The reference setup uses: Vercel (hosting), Neon (PostgreSQL database), Clerk (sign-in) and, optionally, Microsoft 365 / Outlook (PO intake and approval email).

Those providers act for the customer, not for OdysseyDevelopments LLC. OdysseyDevelopments LLC only operates this marketing website, which is hosted on Vercel.

Because customers operate their own deployments, the customer's IT is the first responder for an incident in its workspace. If we confirm an incident affecting our own systems or any customer information we hold, or a flaw in the software that affects customers, we notify affected customers without undue delay, with what we know and what we are doing. Report a vulnerability or concern to Podyssey@odysseydevelopments.dev; please give us reasonable time to fix before public disclosure. We do not pursue good-faith researchers who avoid privacy harm and service disruption.

We do not currently hold a SOC 2 or ISO 27001 certification, and the service is not designed for payment-card, health or government-ID data. We will say so plainly if that changes.