Security
Your data, in a database only you can see.
A per-tenant database isn't an implementation detail — it's the whole security model. Here is exactly how it works, not just that it does.
No shared table to leak across
Your business data lives in its own database file, not a row in a table you share with every other customer. There is no shared schema and no filter bug that could ever put your data next to someone else's in the same query.
Encrypted at rest, per tenant
Every tenant database is encrypted with AES-256-GCM. The key isn't reused across tenants either — each one is derived from a single master secret with HMAC-SHA256, keyed to your tenant ID, so no two tenants ever share literal key material even though there's only one secret to protect and back up.
The model behind Ask and Canvas does not receive your Odoo credentials, your Supabase credentials, raw database access, or an unrestricted query tool. It receives your question, an allow-listed description of the analytics fields, and at most 100 rows back from an allow-listed query.
Denied unless explicitly allowed
Every field in every module has its own AI policy. Anything missing from that allow-list is denied — including every field on a cube you build yourself, until you explicitly allow it. The check runs on measures, dimensions, time dimensions, filters, and sorting, so a blocked field can't be inferred indirectly through one of those either.
You can verify it yourself
The What AI sees page in your admin console lists every field, labeled AI allowed or AI blocked — the same record the system enforces against, not a separate summary that could drift from reality. A shipped module with no policy, or a policy naming a field that doesn't exist, is refused at startup rather than allowed to run unchecked.
Each module syncs on a fixed interval you choose — from every hour up to once a week. It's a preset list rather than a raw number, so there's no way to accidentally set a sync loose enough to hammer your live Odoo. A dashboard always shows how current its numbers are, so "up to date" is never a guess.
Super admin
Us, the platform operators. We manage tenants and Odoo connections and can trigger or monitor a sync — we do not see your data through any other door.
Client admin
Your company's manager. Sees every dashboard, invites your team, and connects or reconnects your Odoo.
Client user
Views dashboards only. No connection settings, no invites, no admin console.