Security

How Odento protects your data. Learn about our encryption standards, access controls, compliance certifications, and disaster recovery procedures.

Overview

Security is foundational to Odento. As a platform handling sensitive patient health records, dental practice data, and financial transactions, we implement defense-in-depth security across every layer — from infrastructure to application to personnel. All data is stored and processed exclusively in India (Mumbai region) to comply with data residency requirements.

Our security program covers three pillars: data protection (encryption, access control, audit logging), compliance (ABDM, DPDP Act 2023, GST), and resilience (automated backups, disaster recovery, point-in-time recovery).

India Data Residency

All patient data, backups, and logs are stored in India (Mumbai region, asia-south1). No data leaves the country. This complies with the DPDP Act 2023 and ABDM requirements for health data sovereignty.

Screenshot — Overview

Security Topics

Explore each area of our security program in detail:

Data Protection

Encryption at rest and in transit, GCS storage, access control, and audit logs.

Compliance

ABDM compliance, data residency (India only), DPDP Act 2023, GST, and medical records standards.

Backup & Recovery

Automated daily backups, point-in-time recovery, disaster recovery plan, and data export.

Screenshot — Security Topics

Key Security Principles

Encryption everywhere: AES-256-GCM at rest, TLS 1.3 in transit. No plaintext data stored.
Least privilege access: Role-based access control (RBAC) with granular permissions. No default admin access.
Audit everything: Every data access, modification, and API call is logged with user, timestamp, and action.
Data residency: All data stays in India. No cross-border data transfer.
Regular backups: Automated daily backups with point-in-time recovery (up to 7 days).
No Firebase: We use custom JWT auth, GCS storage, and PostHog analytics — no Google Firebase services.

Authentication

Odento uses a custom JWT-based authentication system. Access tokens are short-lived (15 minutes) and refresh tokens are long-lived (30 days). OTP is sent via WhatsApp (with SMS fallback) for login and registration. Password-based authentication is available as a secondary method.

JWT access tokens: 15-minute expiry, signed with RS256
JWT refresh tokens: 30-day expiry, rotated on use
WhatsApp OTP (primary): 6-digit code, 5-minute validity, 3 attempts max
SMS OTP (fallback): via 2Factor API when WhatsApp fails
Session management: concurrent session limits, remote logout

Infrastructure Security

Odento runs on Google Cloud Platform (GCP) in the asia-south1 (Mumbai) region:

Compute: Compute Engine VMs (1 per region, all services inside, attached disk). No Cloud Run.
Database: PostgreSQL 18 on each regional VM (attached SSD, localhost only).
Cache: Redis (AOF + RDB on disk for persistence).
Storage: Google Cloud Storage (GCS) via signed URLs for file uploads.
CDN/DNS: Cloudflare for domain management, SSL, and CDN.
Frontend hosting: Vercel (Mumbai region, bom1).
Network: All internal communication over private IPs. No database port exposed to the internet.

No Firebase

Odento does not use any Firebase services. Authentication is custom JWT, storage is GCS, push notifications are via OneSignal, and analytics via PostHog. This gives us full control over data residency and security.

Reporting Security Issues

If you discover a security vulnerability in Odento, please report it responsibly:

Email: security@odento.app
Do not publicly disclose the vulnerability until it has been fixed.
Provide a detailed description and steps to reproduce.
We acknowledge all reports within 48 hours and provide a fix timeline.
We do not pursue legal action against good-faith security researchers.