Security & data handling

• Creating, viewing, editing and reassessing an opportunity all require an authenticated account. Your deals are reachable by you; where your organisation uses Onden's manager features, the managers and administrators of that organisation can also see the deals within it. Onden staff can reach support, bug and access-request records you send us.
• Records are owned by the account that created them and enforced with row-level access rules in the database, so one account cannot read another's data.
• Ownership is always derived from the verified server-side session, never from values supplied by the browser.
• Your plan is held on the server. It cannot be changed from the browser, and an admin preview mode changes presentation only.

A visitor who has not created an account can run a small number of free guest deal analyses on /try/deal. Guest runs are rate limited per visitor and overall, and the input is treated as untrusted text, not instructions. Against the rate-limiting record we keep only that a run happened, its outcome and how long it took, keyed to a non-reversible caller identifier. Separately, so the analysis is not lost if the visitor creates an account, the text they submitted and the result are held on our servers behind an unguessable single-use token that lives only in that browser tab. The token can be claimed for 24 hours. Once the analysis has been moved into the new account the held text and result are cleared immediately, leaving only the record needed to stop a repeated claim creating a duplicate deal; that record, and any copy nobody claimed, is deleted by an automatic cleanup that runs every hour, and in no case later than 30 days after the claim.

Signing up at any point moves you into the normal authenticated product, where that deal can be saved as a real opportunity.

• AI analysis and document generation run on our servers, not in your browser — for signed-in accounts behind authentication, and for a guest run behind the rate limits described above. Model calls are made server-side to a third-party AI model gateway (currently Lovable AI); we do not claim any provider's certification as our own.
• Customer research is restricted to the customer website saved on the opportunity. Before every request — including each redirect hop — the crawler rejects loopback, private and reserved addresses and hosts that resolve to them, and refuses redirects that leave that site.
• The browser cannot supply an arbitrary research target; the URL comes from your saved opportunity record.
• Provider API keys are held server-side and are never exposed to the browser.

The new-opportunity form keeps an in-progress draft in your browser tab's session storage so a signed-out visitor does not lose their input while creating an account. That draft never leaves your browser as a separate transmission, is cleared when the opportunity is saved successfully or when the tab closes, and is only ever read by the same browser tab. Product-usage analytics events record interaction names, the page area you were in, an anonymous browser identifier and, when you are signed in, your account identifier and plan — never customer, stakeholder or deal content.

Two smaller traces do exist: an opportunity's web address, and the "last visited" key kept for it, can contain a short slug derived from the customer name you typed, so the page can be linked and bookmarked normally. No other deal content is written to browser storage or to a web address. Product-usage analytics (a local event buffer and the durable record alike) are stripped to a known list of fields — page area, anonymous browser id, account id and plan when signed in — and never carry customer or deal content.

• You can delete an individual opportunity from its workspace, and delete all of your Onden data or close your account using “Delete my data” in the workspace sidebar.
• These actions are permanent, run server-side against your own records only, and remove the rows from the live database (opportunities, stakeholders, evidence, workspace state, documents and buying-role assignments).
• Copies may remain for a period in our cloud provider's infrastructure-level backups, which we do not control and cannot selectively edit.
• We do not maintain a full audit trail of access to your data, and we do not offer customer-managed retention schedules or legal-hold controls.
• A guest analysis waiting to be moved into a new account sits behind an unguessable single-use token that can be claimed for 24 hours. The held text and result are cleared the moment it is imported, leaving only the record that prevents a repeated claim creating a duplicate deal. An automatic hourly cleanup removes unclaimed copies once they expire and claimed records after 30 days. Once imported it is an ordinary opportunity and the deletion options above apply.
• The rate-limiting record for guest runs holds only status and duration against a non-reversible caller key, never the guest's input.

Onden holds no security certification today. We make no SOC 2, ISO 27001, HIPAA, PCI or formal GDPR-compliance claim, and we offer no data-residency guarantee, uptime commitment or contractual encryption guarantee beyond the protections our cloud infrastructure provides by default. A full audit trail and customer-managed retention controls are not implemented.

Onden runs on managed cloud infrastructure operated by our hosting and database providers, and inherits the platform-level controls they operate. Any certification held by a provider belongs to that provider and is not a certification of Onden.

If you believe you have found a security issue, please report it through our contact page (choose "Security and data handling"), by emailing hello@onden.ai, or via Help & feedback → Contact support inside the product, and avoid accessing data that is not yours. We will confirm receipt and prioritise it. See also the privacy notice.