Built for production. Built to pass a security review.
One posture across every product. EU-hosted by default, role-based access, audit trails on every record, scoped and revocable keys, data export on demand.
On the record
The answers a security reviewer asks for first, with the document each one comes from.
- Hosting
- Odoo SA's EU cloud platform for the customer record; Scaleway, Paris, for the optimization service Data processing agreement, Annex 2.2
- Encryption
- at rest and in transit, on the platform Data processing agreement, Annex 2.3
- Backups
- daily and encrypted, with a documented restore procedure Data processing agreement, Annex 2.5
- Sub-processors
- Odoo SA, Scaleway, Mapbox, Google Ireland, OpenWeather Data processing agreement, Annex 3
- Breach notification
- 48 hours Data processing agreement, section 9
- Payload retention
- 90 days Data retention policy
- Data-subject requests
- answered within 30 days Privacy policy, section 7
- Cookies
- session and CSRF only; the Studio keeps your editor buffer and preferences in your browser's local storage Privacy policy, section 4
Where your data lives
EU hosting by default
Shared instances run on Odoo SA's EU cloud platform, managed by NexOR, and the optimization service runs on Scaleway in Paris. Private deployments are scoped per customer.
EU, GDPR-aligned
No replication out of the EU
We never replicate customer data outside the EU without an explicit contractual choice.
Export on demand
Your data, exportable in standard formats whenever you ask. No proprietary file lock.
Who can see what, and who did what
Role-based access
Granular permissions per module, per record. Multi-company support out of the box.
Token-based APIs
Bearer-token auth, per-integration credentials, rotation on demand. No shared passwords.
Audit trail
Every record change is tracked through Odoo's chatter. Who changed what, and when.
How we run it day to day
Encrypted, backed up
Encryption at rest and in transit, and daily backups with point-in-time restore, come from the platform underneath.
Isolated environments
Production and non-production data stay separated; test and staging never carry live credentials.
A signed data-processing agreement
Signed at on-boarding and reviewed on every material change. The template is on the legal page.
How we harden the service
Optimization as a Service carries four guarantees beyond the platform posture.
Scoped, revocable keys
Named API keys work only on the optimisation API, and you can revoke or rotate any of them on demand.
Signed webhooks
Every delivery carries an HMAC signature, so your endpoint can verify it came from us.
X-Solve-Signature,
HMAC SHA-256
Guarded egress
Webhook targets are checked against private and metadata ranges before we ever connect.
Escrowed billing
We reserve the worst-case cost before a run starts, so it can never exceed the cap you set.
What we ship, and what we are working toward
In place today
- GDPR-aligned data handling
- EU hosting on Odoo's cloud platform
- Encrypted backups, point-in-time restore
- Audit trail on every record
- Token rotation and role-based access
On the roadmap
- SOC 2 readiness
- ISO 27001 alignment
- Penetration-test reports on request
- SSO and SAML on request
Last reviewed: 2 September 2026
Need our security pack
We send a security questionnaire, data-flow diagram and SLA on request, within one business day.