Security

Please use the recommended channels to report security issues, either by chat or e-mail. Avoid reporting security issues via other public channels.

Introduction#

Security of our customers' data is a top priority at Odyssey. This document describes our security processes and how we work with security in general.

This document is updated whenever new security policies are added to our processes.

There may be special agreements with individual customers regarding security. Special agreements supersede this document.

Peter Lapalus, Head of Engineering at Odyssey, is responsible for security. For any security-related question, contact us at security (at) odyssey.se.

Data Protection#

Data Storage#

We store most of our data in Google Cloud services, only at locations within the EU/EEA. Exceptions to this are user accounts (email, name and passwords), stored in Auth0 Authentication Services, also at locations within the EU/EEA, and HubSpot, used for communication with users and business contacts.

All access to our systems is made strictly through encrypted connections, using the built-in security systems of Google and Auth0.

Where the customer owns data stored as part of the services we deliver, and the customer terminates its contracts or subscriptions with Odyssey, the customer may request a full data export in a standardised format from Odyssey.

Upon termination of the contract, all customer-owned data in Odyssey services will be deleted on request within 30 days. Within another 30 days, all data is also removed from all backup systems. Requests for data deletion should be sent to support (at) odyssey.se.

Data Processors#

To deliver the services, we use sub-processors that process personal data within our systems. We carefully evaluate and select processors with regard to security, secure communication and data storage policies.

See the full list of sub-processors that process customer data.

General Security#

Risk classification of personal data#

All customers should do their own risk classification of the data they store in Odyssey's systems.

The following statements about stored data can be used for your own risk assessment:

• Odyssey stores customer information about the users. The information includes the name, e-mail address, company identifier and IP address of each interaction.
• Odyssey also stores the name, e-mail address, and (a securely hashed) password for each logged in user in the system.
• Odyssey sometimes stores users' phone numbers if they are supplied in support processes or business-related communication, such as signing a contract or business inquiries.
• In rare cases, Odyssey also stores information about your (the customer's) end customers (B2C/B2B) to conduct research about them. We then store name, email and sometimes customer identification numbers. Odyssey then acts as a sub-processor to you, and a separate sub-processor agreement should be signed.
• Odyssey stores information about how its services have been accessed in the form of log files. These log files are kept for 30 days and are then deleted.
• Odyssey stores logs of authentication and authorization activities. These logs are stored for six (6) months and are then deleted.
• Personal information about you as a user is kept in our systems for as long as you remain a user of our services. User accounts are scheduled for deletion on termination. Inactive user accounts (users who have not logged in) are permanently deleted after one (1) year of inactivity. We may store contact information for business and legal contacts longer than that if needed.

Staff#

Odyssey staff members share responsibility for customer support. To make customer support efficient, Odyssey staff with a direct need have access to customer data. All access to customer data is made through a web interface with user access controls in place, so access for a user can be withdrawn at any time. Staff with access to customer data and personal data originating in the EU work in, and originate from, an EU member state.

All staff members are given a walkthrough of our security policy upon employment, and are required to follow the procedures outlined strictly.

All staff members take part in keeping our customers' data safe at all times and are trained to do so. Our security practices are developed and maintained by the security team within the IT department.

Logging#

Odyssey logs activities within our systems, mainly for debugging purposes. Logs are only available to Odyssey staff members in the IT and development teams.

Examples of data that is logged in our systems:

• All web traffic to each public context hosted by Odyssey, including IP address and web browser information.
• All authentication and authorization activities in our systems.
• All errors that occur through use of the services.
• All e-mails sent by the services.

A customer may request logs pertaining to their own use of the system, provided that the customer covers any extra support cost and that Odyssey agrees to it. Depending on the complexity of the logs and whether customer-specific information can be isolated, Odyssey may or may not comply with the request. Full logs cannot be handed over, since they may contain data that originates from other customers.

All logs are automatically deleted after 30 days due to privacy agreements with our customers, except authentication and authorization logs, which are kept for 6 months.

Physical security#

Odyssey owns no physical servers or data centers; instead, we use managed services from Google Cloud. Google is responsible for the physical security of the premises hosting the systems and servers, and has comprehensive security documentation.

Gaining access to Odyssey offices, networks or locations does not automatically give anyone access to any of our services.

Operational security#

Odyssey monitors all its critical infrastructure, mainly for security purposes but also for performance and to find issues with our systems.

All data transfer happens digitally, so no physical transfer of data is ever conducted.

All encryption keys, access keys and other secret keys are stored in encrypted form and are only available in the specific environment where they are used.

We continuously monitor industry standards and make updates to our setup accordingly.

Development processes#

Security solutions are based on industry best practices for protocols, authentication and encryption. We don't build our own security solutions; instead, we trust the proven work of others and use security infrastructure from our infrastructure providers.

Software development is conducted in a way that ensures high quality, according to standards, with testing built in throughout the process.

Environments used for testing are clearly separated from production systems.

Access Transparency and Access Approval#

Odyssey uses services within Google Cloud called Access Transparency and Access Approval to log and prevent unauthorized access to Odyssey systems and services by staff working for Google Cloud. No employees or subcontractors of Google Cloud can access Odyssey services without approval from Odyssey.

Read more at Google Cloud.

Encryption#

In transit#

Every time data is transferred, it is protected by secure, encrypted protocols.

Where Odyssey exposes part of the information on the internet, we use TLS to encrypt data in transit. TLS is also used internally between system parts. Odyssey currently requires at least TLS 1.2 for all requests within our system.

Private keys for our certificates are stored with an extra layer of encryption. Any private keys that are suspected of being tampered with are immediately discarded and new keys are generated.

At rest#

All data in our databases is encrypted at rest, protecting against data leakage and ensuring compliance with EDPB recommendations.

Access to encryption keys is limited to Odyssey technical staff, and all usage is monitored with audit logs. We use Google Cloud Key Management Service to manage our keys.

Public access and network security#

Odyssey uses Cloudflare to protect our publicly accessible services, with the Cloudflare firewall in front of all our services. We use Cloudflare services such as WAF (Web Application Firewall), bot protection and brute-force protection, among many others. Apart from Cloudflare, Auth0 also has protection against brute-force attacks and IP throttling. The Google Cloud front-end firewall also provides protection similar to Cloudflare's in front of all services.

Password management and requirements#

Passwords are never stored in plain text. Instead, they are hashed with a strong hashing algorithm. This is handled by Auth0. Odyssey employees therefore have no way of seeing or accessing the plain-text passwords.

Passwords are never sent directly to a user, except for a one-time password with limited validity, sent to the user's e-mail when the account is first activated. The user must then set a new password.

Password resets are handled by generating a new time limited link that the user clicks to change the password.

No standard passwords are used, each user has a unique password.

The following rules are enforced when creating a new user:

• Passwords cannot be too similar to the user's email or name.
• Passwords must follow a complex pattern and have a specific minimum length.
• Passwords cannot be among the top 10000 passwords used globally.
• Passwords cannot contain only numbers.

Passwords are never stored on the client. Passwords are never stored in logs. Passwords are never stored in session variables or cookies.

We have a specific password breach protection system provided by Auth0. We’ll notify users if they use a password and username combination that has been compromised in a data leak on a third-party website or app.

Two-step verification can be turned on for each organisation, as optional or required. Users then confirm their sign-in with a second step, such as a code sent to their email, an authenticator app, a security key or a passkey. Two-step verification does not apply to single sign-on, where the organisation’s own login decides.