Trust

• Hosting in the EU. The platform and database run on Amazon Web Services in the EU. The database sits in a private network and cannot be reached directly from the internet.
• Encryption. Data is encrypted in transit and at rest.
• Access. Authorisation is checked on every request, and each customer's data is kept separate.
• Logs. Technical logs are kept for 14 days. They contain no IP addresses or request content.
• Backups. The database is backed up automatically. Backups are kept for 7 days.
• Abuse protection. Public forms have request limits and protection against forged submissions.
• Certifications. Ody currently holds no certification of its own, such as ISO 27001 or SOC 2. Amazon Web Services' certifications cover the infrastructure we use.

Found a vulnerability? Write to security@ody.one.

Ody has two roles, depending on where the data is processed.

	The platform	The website and form
Controller	You, the customer	Ody
Ody's role	Processor	Controller
Governed by	The data processing agreement	The privacy notice

In the platform, you decide why and how data is processed. You are responsible for the legal basis and for informing employees before data is collected. We process the data only on your instructions.

We help with the paperwork: a pre-filled data protection impact assessment (DPIA) template, support for the legitimate interest assessment and an information text for employees.

Data subject rights. Employees who want access, rectification or erasure, or who want to object, contact you as their employer. We help you retrieve or delete the data.

When the agreement ends, you can export your data for 30 days. It is then deleted. Data in backups disappears within 7 days.

How AI is used. AI guides you in the chat, proposes plans and activities, and explains results in words. AI makes no decisions about individuals.

Models and location. We use Claude models from Anthropic through Amazon Bedrock. Requests are processed in the EU, though not always in the same EU country.

Your data. The AI provider does not store the content of requests and never uses it to train its models. Anthropic has no access to your data.

How we develop Ody. We use aggregated, anonymised statistics from several organisations to develop Ody and give more accurate advice and recommendations, for example by industry. The statistics cannot be traced back to your organisation or to individuals, and we do not train AI models on them.

Disclosure. Users are told when they interact with AI.

The EU AI Act. We have a plan for how Ody meets the EU AI Act and update it as the Commission's classification guidance is finalised. We adapt Ody to our customers' different requirements. We share the plan on request.

People decide. Ody provides recommendations. A person in your organisation always decides what happens.

Ody can map whom employees turn to for advice and support, using a short survey. This helps you find colleagues who can support the change. Ody analyses survey answers only, never email, calendars or chats.

• For change work only. The data is never used to assess performance or make personnel decisions.
• Information before the survey. All affected employees are informed before the survey is sent.

We use a small number of subprocessors, including for hosting, email and AI processing. The list shows what each one does, which data it touches and where it is processed. We notify customers at least 30 days before adding or replacing a subprocessor.

These are the documents that govern the service and how we process data: terms of service and data processing agreement. The service description, our plan for the EU AI Act, a DPIA template, support for the legitimate interest assessment and an information text for employees are available on request to customers and procurers.

• Data protection: privacy@ody.one
• Security and vulnerabilities: security@ody.one, see also /.well-known/security.txt

Ody AB, company reg. no. 559546-8124, Tyresö, Sweden.