<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=9151474&amp;fmt=gif">
Skip to content

Your data, handled with care.

This page is the security section of our vendor questionnaire, in plain words: where your data lives, who can reach it, how we protect it, and what we do not have yet. Everything here is what we put in writing to customers.

Ask for the vendor pack What we hold, and what we do not
app.odins.ai / verification

Forecast vs actualsforecast made at the cutoff, before actuals arrived

91% accuracy
model cutoff
Actuals Forecast
Your data

Yours, stored in the EU.

Everything you provide, and everything we collect and structure for you, remains your property for the whole contract and after it.

  • Stored and processed in Google Cloud's EU regions. We configure every storage location for EU residency and give you advance notice before any change.
  • The modelling data is aggregated marketing and sales data with no personal data in it. The only personal data we process for you is your users' name, business email and login metadata.
  • If you leave, you keep everything: a final export in a standard format such as CSV, then deletion or return within 30 days.
  • Personal data leaves the EEA only to the vendors on our Sub-processor Register, each under the vendor's DPA and the EU Standard Contractual Clauses. The register is shared on request.
  • One caveat we state up front: our ingestion tool handles incremental-sync cursor and primary-key metadata in a US control plane. The modelling data itself stays in the EU data plane, and we never use personal data as cursor or key.

In practice

What is in place, and where it stands.

Security questionnaires ask for mechanisms, tools and cadences. Here they are.

What is in place
Where it stands
Certifications
What is in placeOdins.ai holds no ISO 27001 certificate or SOC 2 report of its own. We run on Google Cloud, which is certified under ISO/IEC 27001, 27017 and 27018.
Where it standsAn ISO 27001 and SOC 2 programme is under way, and we will not claim either until a report exists.
Encryption
What is in placeTLS 1.2 and 1.3 in transit, AES-256 at rest. Keys are owned and managed by Google. Application secrets live in Google Secret Manager, employee credentials in 1Password.
Where it standsIn place.
Access control
What is in placeRole-based access with quarterly reviews and immediate revocation on role change or departure. Employees sign in through Google Workspace SSO and GCP IAM, with MFA and VPN for remote production access.
Where it standsIn place. Customer-side SSO or AD integration, two-factor login and IP filtering are available; SSO and AD at extra cost.
Tenant separation
What is in placeA multi-tenant setup with logical separation per organisation.
Where it standsIn place. A logically separated deployment is a paid option.
Backups
What is in placeAutomated daily backups at 02:00 UTC with point-in-time recovery: 15 daily backups and 14 days of transaction logs, so we can restore to any point in the last 14 days.
Where it standsIn place. Cross-region backups and scheduled restore tests can be set up by agreement.
Vulnerability management
What is in placeGitHub Dependabot monitors dependencies continuously. An automated routine reviews and applies updates every Monday across all repositories. Container images are scanned nightly with Trivy, and the cloud configuration nightly with Prowler against SOC 2, ISO 27001 and CIS benchmarks.
Where it standsIn place. Remediation windows: critical within 7 days, high 30, medium 90, low 180. A critical production vulnerability is fixed immediately.
Monitoring
What is in placeSentry and Google Cloud Logging, with alerts on every data connector. Incidents run through a defined process in Linear.
Where it standsIn place.
Incident notification
What is in placeWe notify your security contact within 48 hours of discovering a vulnerability or breach affecting your data, with details and proposed mitigations, and keep you updated until it is resolved.
Where it standsIn place. For personal data the DPA's "without undue delay" applies where it is stricter.
Change management
What is in placeFeature-flagged, trunk-based development. No change reaches production except through a reviewed pull request with green checks from automated unit and integration tests.
Where it standsIn place.
Audits and penetration tests
What is in placeYou may audit us, directly or through a third party, and you may run your own penetration test, subject to reasonable scheduling and confidentiality. We provide security logs on request.
Where it standsIn place.
Continuity
What is in placeA Business Continuity Plan covering recovery strategies, roles, communication and resources, reviewed annually. Perimeter is Google Cloud Run behind an external load balancer with Cloud CDN; Cloud Armor can be enabled on request.
Where it standsShared under NDA.
On paper

Contracts you already know.

Odins.ai AS (org. no. 831 930 772, Oslo) is the data processor in every customer agreement. Our CEO signs; our CTO owns security and compliance.

  • Our Data Processing Agreement is built on the EDPB Article 28 standard clauses, which the Norwegian Data Protection Authority accepts. If you prefer your own DPA or the Norwegian SSA-L standard, we review it against our positions instead of insisting on ours.
  • Sub-processor changes come with four weeks' notice.
  • For banks and other financial entities we offer a DORA ICT addendum. Our position: Odins is decision support for marketing budgeting, not a critical or important function, and the designation is yours to make.
  • Support runs 09:00 to 17:00 CET on business days through support@odins.ai, under a written service-level agreement.
  • We comply with GDPR and with Norwegian labour and contract law. Our own record of processing is kept in AdminKit; our privacy policy is public.
FAQ

Questions security teams ask.

Are you ISO 27001 certified or SOC 2 audited?

Not yet. Odins.ai holds no certificate or report of its own. Our infrastructure, Google Cloud, is certified under ISO/IEC 27001, 27017 and 27018. An ISO 27001 and SOC 2 programme is under way, and we say so plainly in every questionnaire rather than imply something we do not have. If your procurement needs us to pursue certification on a timeline, we are open to discussing cost and timing.

Where is our data stored?

In Google Cloud's EU regions. We configure storage locations explicitly for EU residency, and any change of location comes with advance notice under the DPA. Synced data is processed in an EU data plane; incremental-sync cursor and primary-key metadata is handled by our ingestion tool's US control plane, and we never use personal data in those fields.

Who owns the data?

You do. Everything you provide, and everything we collect and structure for you, remains your exclusive property. It is available to you throughout the contract, and if you leave you get a final export in a standard format such as CSV, followed by deletion or return within 30 days.

What personal data do you process?

Very little. The marketing and sales data we model is aggregated and contains no personal data. The only personal data we process on your behalf is your platform users' full name, business email, and login and usage metadata. No special categories, no national identity numbers. On request we export or delete it within 30 days, usually much sooner.

Can we run our own security audit or penetration test?

Yes to both, subject to reasonable scheduling and confidentiality. We provide documentation, coordinate with Google Cloud where relevant, and support evidence collection as long as it does not breach other customers' confidentiality.

How fast do you tell us about an incident?

Within 48 hours of discovering a vulnerability or breach affecting your data, with details and proposed mitigations, then updates until it is resolved. For personal data the DPA's "without undue delay" applies where it is stricter.

Will you sign our DPA?

Usually, yes. Large buyers often arrive with their own DPA or the Norwegian SSA-L standard, and we review that paper against our standard positions instead of forcing ours. When we lead with our own DPA, it is built on the EDPB Article 28 standard clauses.

Can you fill in our security questionnaire?

Yes. Send it to sales@odins.ai. Every answer names the mechanism, the tool and the cadence, and where the answer is no or partial we say so. The content of this page is the short version of what you will get back.

Is our data shared with anyone?

No customer data is shared with third parties without your written consent. The vendors that can touch customer data are listed in our Sub-processor Register, which we share on request, and changes to it come with four weeks' notice.

Running a security review?

Send us the questionnaire.

You get it back with concrete answers, and the vendor pack with the DPA template, the sub-processor register and the SLA.

Email sales@odins.ai