Security

Version 2026-10 · 10 October 2026 · subject to legal review

Effective from 10 October 2026.

This page summarizes how we protect the data in OutDo. The contractual commitments are in the DPA and, for Enterprise, in the SLA.

Infrastructure

• Production runs on our own bare-metal servers at OVH in Gravelines, France.
• The database, authentication, file storage and synchronization are self-hosted (Supabase and PowerSync), with no shared third-party data platform.
• Third parties receive only the data needed for their function; see the subprocessors.

Data isolation

• Row-level security on every database table: each query only sees the data the user is allowed to see.
• The apps use a per-user token; no client holds a service key.
• Kiosk and external accounts are isolated and only reach what was shared with them.
• For offline use, the app keeps a local copy (SQLite) of the data the user can access, removed on sign-out.

Authentication

• Email and password with at least 8 characters; passwords are stored only as hashes.
• Sign-in with Google or Microsoft accounts.
• Single sign-on (SSO) on the Enterprise plan.

API

• API keys (outdo_sk_) are shown only once and stored as hashes.
• Each key has scopes (read, write, structure), an expiry date and is revoked automatically when it expires.
• Rate limits per IP address and per key, with a 429 response and a Retry-After header.

Encryption

• TLS on every connection in transit, between devices, servers and providers.
• Secrets at rest, such as the AI provider keys you bring (BYOK, Enterprise), are encrypted in the database with pgcrypto.

Audit logs

• Per-organization log of data changes, kept for 365 days.
• Log of administrative actions in the portal.
• API request log for 90 days, without IP address or user agent.

Backups

• Continuous archiving of database changes, with point-in-time recovery for 30 days.
• Daily full backups, copied off-site to a separate OVH S3 bucket in Gravelines.
• Virtual machine snapshots (the latest 60 on site) with off-site copies.

Monitoring

We monitor the service continuously and publish its state on the status page. Application errors are reported to Sentry, hosted in the EU.

Reporting a vulnerability

If you find a vulnerability, write to security@out-do.app with the steps to reproduce it. We ask that you do not access other people's data or disrupt the service, and that you give us reasonable time to fix it before disclosure.

In preparation

• Multi-factor authentication (MFA).
• Disk-level encryption at rest.
• Regular reporting of restore drills.