Security
Security, stated plainly
What OdysseyGPT does to protect your documents today, and what it doesn't offer yet. Your vendor review can start from facts.
Last reviewed:
Hosting
OdysseyGPT is hosted on Render in the United States (US-East, Virginia). Uploaded files are stored in Cloudflare R2.
Deployment
OdysseyGPT is a managed, multi-tenant cloud service. We don't offer customer VPC, on-premises, air-gapped or dedicated single-tenant deployments.
Certifications
OdysseyGPT does not hold SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP or any other security certification or attestation today.
Identity and access
- Workspace roles (Owner, Admin, Member and Guest) control who can see and change what.
- Each workspace keeps a tamper-evident (hash-chained) audit log. It records sign-ins, document uploads, views, downloads and deletions, exports, questions and answers.
- SAML and OIDC single sign-on is not generally available yet; ask us about its status.
Data protection
- Data is encrypted in transit with HTTPS (TLS).
- Our hosting and storage providers encrypt data at rest. Cloudflare R2 encrypts every stored file with AES-256.
- When you delete a document, we remove it for good. That includes its extracted content and its stored original file.
- Customer data is hosted and processed in the United States. We don't offer EU or UK data residency today.
- We do not train or fine-tune AI models on customer data.
Security questions
How is OdysseyGPT deployed?
OdysseyGPT is a managed, multi-tenant cloud service. We don't offer customer VPC, on-premises, air-gapped or dedicated single-tenant deployments. OdysseyGPT is hosted on Render in the United States (US-East, Virginia). Uploaded files are stored in Cloudflare R2.
Can OdysseyGPT be deployed on-premises, air-gapped or in our own VPC?
No. OdysseyGPT is a managed, multi-tenant cloud service. We don't offer customer VPC, on-premises, air-gapped or dedicated single-tenant deployments.
Where is our data stored?
Customer data is hosted and processed in the United States. We don't offer EU or UK data residency today. Uploaded files are stored in Cloudflare R2.
Is data encrypted?
Data is encrypted in transit with HTTPS (TLS). Our hosting and storage providers encrypt data at rest. Cloudflare R2 encrypts every stored file with AES-256.
Is OdysseyGPT SOC 2 or ISO 27001 certified?
No. OdysseyGPT does not hold SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP or any other security certification or attestation today. Our hosting and storage providers hold their own SOC 2 Type II reports.
Is OdysseyGPT HIPAA compliant? Do you sign BAAs?
No. OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs).
What access controls and logging are available?
Workspace roles (Owner, Admin, Member and Guest) control who can see and change what. Each workspace keeps a tamper-evident (hash-chained) audit log. It records sign-ins, document uploads, views, downloads and deletions, exports, questions and answers. SAML and OIDC single sign-on is not generally available yet; ask us about its status.
Is our data used to train AI models?
We do not train or fine-tune AI models on customer data.
Need a security review package?
Tell us about your questionnaire and what you need. We will answer based on what is in place today.
Prefer to send the questionnaire directly? Email security@odysseygpt.ai.