Security

🏛️Architecture & security

Modern stack, strict per-customer data isolation, encrypted credentials, human approval of every write.

Technical stack#

UpBoard builds on proven open-source components, hosted in Switzerland.

Data isolation#

Isolation between customers is enforced at several levels:

Per-customer filter on every query

Every piece of UpBoard data carries its customer's identifier. Every read, update or delete filters on it, and an automated check blocks any code that forgets it in continuous integration.

Encrypted ERP credentials

Odoo API keys and credentials are encrypted at rest (Fernet), with a key rotation mechanism. Secret fields read from Odoo are masked before any caching.

Sensitive models blocked

The connector refuses to access sensitive Odoo models: system parameters, mail servers, user API keys.

Per-customer agent memory

Each agent's contextual memory is strictly tied to one customer. No model learns from all customers' data.

Encryption#

• In transit: TLS between your browser, UpBoard and your Odoo
• ERP credentials: encrypted at rest (Fernet), with a key rotation mechanism
• Passwords: hashed (bcrypt), never stored in clear text
• Backups: encrypted (AES-256) before they leave the server
• Application secrets: kept in server configuration, never in the code

Human approval and logging#

• Human approval: every write to Odoo (create, update, delete, method call) waits for your explicit approval, with no way around it
• Logging: AI model calls and approved actions are recorded
• Masking: emails, phone numbers, IBANs and national IDs are masked in logs
• Sessions: a password change invalidates earlier sessions; two-factor authentication with a code sent by email is available: off by default, each user can turn it on and an admin can require it for the whole organisation

Audits and certifications#

• Security audit: full internal audit completed in June 2026, followed by fixes deployed to production
• Certifications: UpBoard holds no SOC 2 or ISO 27001 certification today; its host Infomaniak is ISO 27001 certified

Incident notification#

If a security incident affects your data, you are notified by email without undue delay after detection with:

• Nature of the incident
• Potentially affected data
• Remediation measures taken
• Recommended actions on your side

This notification is also a GDPR obligation for personal data breaches.

Read next

• GDPR complianceLegal basis, subprocessors, your rights.
• HostingInfomaniak, Switzerland.
• Odoo integrationERP connection security.

See UpBoard working on your Odoo data

A few minutes, read-only, no card. Then a trial on your real data: 14 days, or until the trial credit is used up.

Free diagnostic of my Odoo

Rather talk it through? Book a demo