Security

Everything runs over https. Every page sends fixed security settings: no other site may show Oddrank in a frame, the browser does not guess file types, a link to another site only passes on our domain and never the address of the page, and camera, microphone and location are switched off.

We do not store your password, not even encrypted. We only keep a fingerprint (scrypt, with its own salt per account) from which the password cannot be recovered.

After signing in you get a signed cookie that scripts on the page cannot read, that is only sent over https and that expires after 30 days. If you change your password, all old sessions stop working. Too many wrong attempts, per address or per account, and signing in is blocked for a while.

You can turn on two-step verification: after your password we then also ask for a six-digit code from an app on your phone. The owner can make it required for the whole team.

Within Enterprise, employees can sign in with their organisation's account at Microsoft (Entra ID) or Google Workspace (SSO). We set this up for you on request. Only addresses on domains you have shown to belong to your organisation get in this way. If you want, we switch off signing in with just a password for the members of your organisation.

Also within Enterprise: adding and removing employees from your organisation's own system, through SCIM. We tested this the way Entra ID and Okta do it. Anyone removed there is signed out at once and can no longer get in through SSO either.

When you connect your site or a Google service, we store the key or token encrypted (AES-256-GCM). The key to open them only lives in our hosting environment, not in the database. Each encrypted secret belongs to one customer, and for a site connection also to that site: copied anywhere else, it does not work.

A connection only asks for the permissions we need for the work.

Every night we make a backup, separate from the main database. It is encrypted with its own key (AES-256-GCM), and before we store it we open it and count the contents, so we know it works. We keep a backup for at most 30 days.

You, and the colleagues you invite. A colleague has their own account with their own password. Only you manage the team and the payments.

At our end the admins work in a protected admin area. An admin signs in with a personal login and a code from an app; a shared access key still works as well. Whoever is in can reach all accounts. Every time someone in the admin area opens an account or changes something, it goes into a log. Under the data processing agreement only the people working on your account look at your data, and they keep it confidential. That is an agreement, not a technical separation per customer. Ekster, our chat, only sees your own measurements when you are signed in.

Which other companies process data for us is listed in our data processing agreement (in Dutch).

If we discover a data breach that affects your data, we tell you without undue delay and at the latest within 48 hours, with what we know and what we are doing about it. This is in article 7 of the data processing agreement (in Dutch).

Our AI reads text from outside: web pages, answers from AI assistants and messages. Someone can try to use that to steer our AI. So we test with a fixed set of attack texts in Dutch and English: with a trial version on every change to the code, and from our admin area with the real models.

Outside text is kept separate in the instructions to the model, and the code itself blocks unknown links and email addresses in pages we publish for customers.

We do not hold an ISO 27001 or SOC 2 certificate and have no report from an external penetration test. Signing in through SAML is not possible; SSO only works through Microsoft and Google. If you ask, we will say so.

Found a weakness in Oddrank? Email security@oddrank.nl or info@oddbird.nl, with what you found and how we can reproduce it. Go no further than needed to show it, and do not look at other people's data.

The same is available for computers in /.well-known/security.txt.