Security and data handling

We govern systems, not people.

Odau reads the systems of record your company already owns, at the narrowest scope that produces a governed record — and nothing else. This page states what that means in the detail a security reviewer needs.

Scope of access

What Odau reads

Licenses, seats and entitlements Contracts, invoices and renewal terms Directory, role and access records Admin, provisioning and approval events

What Odau will never read

Browsing history or pages visited Screens, keystrokes or session recordings Messages, documents or file contents Anything that turns a colleague into a metric

How we hold the line

Least privilege, read-only

We ask for the narrowest scope that produces the record, and read-only wherever read-only is possible. Odau does not need write access to be useful.

No browser extension

Nothing is installed on your employees’ machines. No part of Odau depends on watching a browser.

Traceable to source

Every field names the system it came from and when it was last read, so your team can audit the number instead of trusting it.

Evidence, not surveillance

Approvals, access reviews, ownership changes and remediation are recorded as governance evidence — actions taken on systems, not observations of people.

Where we are today

Encryption

Encrypted in transit and at rest. Credentials for connected systems live in a managed secret store, never in application records.

Access control

Role-based access inside Odau, SSO through your identity provider, and an audit trail of who viewed or changed what.

Certifications

SOC 2 readiness is underway. We will not claim a certification before it is issued — ask for current status and we will tell you plainly.

A tool with no owner is a governance problem. An employee with a browser is not.

Send this to your security team.

We answer a review questionnaire before you commit to anything — including where we are not ready yet.

Request security review