.svg)
Compliance
& Certifications
Oddr's controls are independently audited and certified — SOC 2 Type II and ISO/IEC 27001:2022 — and maintained on an ongoing basis.
Achieving and maintaining security compliance certifications demonstrates Oddr’s commitment to implementing robust information security measures and aligning with industry best practices. These certifications are not a one-time milestone — they reflect an ongoing investment in security protocols, data protection, and effective risk management.
ISO/IEC 27001:2022
ISO/IEC 27001:2022
Provides independent assurance that Oddr has a certified information security management system.
Oddr is certified to the ISO/IEC 27001:2022 standard, the internationally recognized framework for information security management systems (ISMS).
Issued by: InterCert Inc. - Registration Number: IC-IS-2408113 - Standard: ISO/IEC 27001:2022 - Initial Certification Date: August 13, 2024 - Surveillance Validity: August 12, 2026 - Recertification Date: August 12, 2027.
The ISMS applies to the AI-enabled Revenue Intelligence platform for Law Firms, hosted as a SaaS platform, with the support functions of IT Infrastructure, Human Resources, Legal, and Governance.
Oddr, Inc. — 1098 Phelps Ave, San Jose, CA 95117
Oddr Technologies Pvt Limited — Bavdhan, Pune (MH), India
A copy of the ISO 27001 certificate is available upon request.
SOC 2 Type II
SOC 2 Type II
Provides independent assurance that Oddr’s security controls are audited and operating effectively over time.
Oddr has completed a SOC 2 Type II audit, which examines the design and operating effectiveness of controls over an extended period — not just a point-in-time snapshot.
Auditor: Accorp Partners CPA LLC - Audit Period: July 1, 2024 through June 30, 2025 - Trust Services Criteria: Security, Availability, and Confidentiality - Sub-service Organization: Microsoft Azure (data center services) - Opinion: Unqualified (controls suitably designed and operating effectively) - Exceptions: None noted across all tested controls.
The SOC 2 Type II report is available under NDA to current and prospective customers.
Information Security Management
Oddr operates a formal Information Security Management System (ISMS) that governs how systems and data are protected across the organization. Key components include:
.png){kind=icon}
Risk assessments are performed annually and whenever significant changes in security posture occur. Risks are identified, evaluated for likelihood and impact, and treated with appropriate controls. A risk register and treatment plan are maintained and tracked to completion.
Oddr maintains a comprehensive set of security policies covering access control, change management, incident response, data classification, cryptography, backup and recovery, and media handling. Policies are reviewed at planned intervals or when significant environmental changes occur.
.png){kind=icon}
Information systems are reviewed on at least an annual basis for compliance with Oddr’s security policies and standards. Audit findings are tracked through to closure with corrective actions.
The leadership team conducts annual management review meetings to discuss the security posture, internal audit results, risk landscape, technology trends, incident reports, and security initiatives.
Data Privacy & Regulatory Compliance
For firms processing personal data subject to the GDPR, UK GDPR, Swiss data protection law, or CCPA, Oddr's Data Processing Addendum (DPA) is incorporated into the customer agreement and governs how that data is processed and protected. The DPA includes Standard Contractual Clauses for applicable cross-border transfers.
The DPA is available at https://www.oddr.com/legal/dpa
Employee Security Practices
.png){kind=icon}
All employees and contractors undergo background verification checks in accordance with relevant laws and regulations prior to gaining access to Oddr systems.
.png){kind=icon}
Employees complete mandatory security and privacy awareness training upon hire and annually thereafter. This training covers security requirements, expectations for protecting information assets, and the process for reporting security concerns.
.png){kind=icon}
All employees sign confidentiality agreements and NDAs upon joining. Similar agreements are established with third-party vendors and contractors.
.png){kind=icon}
Oddr requires directors, officers, and employees to observe high standards of business and personal ethics. Annual code of conduct training reinforces these expectations.
Vendor & Sub-Processor Management
Oddr maintains a formal vendor management process. All vendor relationships require signed contracts that include scope of services, roles and responsibilities, compliance requirements, and service levels where applicable.
Oddr reviews the annual SOC report for its sub-processors (including Microsoft Azure) to confirm that outsourced controls are appropriately designed and operating effectively. NDAs are established with all vendors who may access sensitive information.