Security & Trust

Built for teams that answer to auditors.

odnoga is maintained by odnoga to answer the security, privacy and compliance questions your team actually gets asked. This page is app-owner content — not an independent certification.

Download the auditor compliance package

Shared responsibility

Security is layered. Here is who owns what.

Infrastructure providers

• Physical datacenters
• Network / DDoS
• Database & auth uptime
• Payments PCI scope

odnoga (us)

• RLS + audit logs
• Vault key handling
• Anti-abuse + rate limits
• DPA + sub-processor list
• Bug reports triage

You (the customer)

• Choosing which vendors to route to
• Workspace member access
• End-user consent + your own DPA
• Application-level authorization

Controls we enable today

Row-level security on every table

Postgres RLS scopes every row to the correct workspace, tenant, and end-user. Enforced in the database, not the app.

Auth: JWT + optional TOTP 2FA

Supabase Auth issues short-lived JWTs. TOTP 2FA available for all users; enforced for workspace admins.

Phone-hash anti-abuse + Cloudflare Turnstile

Signup is protected by Turnstile and a one-way phone hash (SHA-256 + pepper). We never store your phone number, and we never call or text you for marketing.

Per-workspace virtual API keys

Vendor keys live in Supabase Vault. Your apps use rotating virtual keys, revocable in one click, with per-key scopes and rate limits.

Per-tenant + workspace budget caps

Hard spend ceilings prevent runaway cost from a single tenant or workspace. Enforced in the gateway before the vendor is called.

Full audit trails

Every request, key change, prompt version, MCP tool call, and admin action is written to append-only audit tables you can query.

Honest data residency

Control-plane data lives in an EU-region Supabase project. For inference we only charge and promise a region when the vendor actually publishes an in-region endpoint — see the vendor matrix below.

Our data pledges

Your prompts, requests, and responses are never sold.
Your data is never used to train odnoga models. We do not train models.
Zero-retention mode is available for regulated workloads — request bodies are dropped after routing.
You can export or delete your data at any time from the workspace settings.
Sub-processors are listed publicly and 30-day advance notice is given for changes.

Data residency, vendor by vendor

Residency is not something a gateway can invent. It only exists where the model vendor publishes an in-region endpoint. odnoga routes to that endpoint when it exists, records the region on every request, and charges the regional uplift only when the region was genuinely honoured. In strict mode a request that cannot be served in your region is rejected with residency_blocked rather than quietly routed elsewhere.

Vendor	EU	How it works	Vendor doc
Mistral	Yes — api.eu.mistral.ai	Dedicated EU regional endpoint, processed in EU/EFTA data centres. Vendor charges a regional upcharge, which we pass through as the uplift.	View
xAI	Yes — eu-west-1.api.x.ai	Regional endpoint that fails the request rather than falling back to another region — exactly the behaviour strict residency needs.	View
OpenAI	Enterprise only — separate EU project required	OpenAI ties residency to the Project, set at creation for organisations approved for data residency. A standard key sent to eu.api.openai.com is rejected with 401 incorrect_hostname, so we do not offer it as a self-serve region.	View
Google (Gemini API)	No in-region endpoint on the direct API	Regional and EU multi-region processing exists on Vertex AI with a customer GCP project, not on the direct Gemini API keys a gateway holds.	View
Anthropic	No in-region endpoint on the direct API	Claude is served from a single global API surface; in-region options exist only through Bedrock or Vertex with your own cloud account.	View

Where a vendor has no in-region endpoint, the request runs on that vendor’s global endpoint, the Models page labels it "global endpoint · no EU residency", and no regional uplift is billed.

EU regulation: what applies to odnoga

GDPR — Art. 28 processor duties

You are the controller, odnoga is your processor, and the vendors are sub-processors. Our DPA covers documented instructions, confidentiality, security measures, audit support and deletion on termination.

GDPR — Chapter V transfers

Requests routed to a non-EU vendor endpoint are an international transfer. We rely on Standard Contractual Clauses (Module Two) with each sub-processor; the region and endpoint actually used are recorded on every request so your transfer record is evidence-based.

GDPR — Art. 15–17 data subject rights

Export and erasure run from the workspace Security & data page, including end-user level erasure. Retention TTLs for logs and request bodies are configurable, with zero-retention available.

EU AI Act — deployer transparency

odnoga is infrastructure, not a model provider: we do not train or fine-tune models. Our AI Act statement documents which model providers you are routed to, so you can meet your own transparency and record-keeping duties.

Certifications we inherit

odnoga runs on certified infrastructure. Those certifications belong to our sub-processors, not to odnoga. Our own SOC 2 Type I and ISO 27001 programmes are on the roadmap below.

Provider	Attestations	Purpose	Trust page
Supabase	SOC 2 Type II, HIPAA	Database, auth, edge functions	View
Amazon Web Services	SOC 1/2/3, ISO 27001, PCI DSS L1, HIPAA, FedRAMP	Underlying cloud (via Supabase)	View
Stripe	PCI DSS Level 1, SOC 1/2, ISO 27001	Payments, invoicing	View
Cloudflare	ISO 27001, SOC 2 Type II, PCI DSS	CDN, DDoS, Turnstile captcha	View
Twilio	SOC 2 Type II, ISO 27001, HIPAA	Phone verification (anti-abuse only)	View
Resend	SOC 2 Type II	Transactional email	View

Compliance roadmap

SOC 2 Type I

Target: 2026 Q4

SOC 2 Type II

Target: 2027 Q3

ISO 27001

Target: 2027 Q4

External penetration test cadence: at least annually and after material architectural changes.

Security contact

Report vulnerabilities or ask a security question.

security@odnoga.com

Responsible disclosure

90-day disclosure window. No litigation for good-faith research within scope.

Acceptable use Status All legal docs

This page describes controls enabled today. It is not a certification and does not replace the DPA or an audit report. For contractual commitments, see the DPA and Terms of Service.