Security and data

Your orders, your customers, your control.

Order data tells a lot about a business. Here is exactly how OrderDak handles it.

How your data is used

  • Your orders, files and master data are used only to run OrderDak for your company.
  • They are not used to train AI models unless you choose to allow it, and never to train models used by other customers.
  • Before launch we publish every service that processes your data, what it does and where it is located, and we notify you before adding a new one.

Each customer's data is kept apart

  • Every record carries your company's ID, and the database itself enforces row-level security, so one customer's data cannot be read in another customer's session even if application code has a bug.
  • Files are stored under per-customer paths and served only through short-lived signed links.
  • ERP credentials are encrypted with per-customer keys.
  • Each AI request contains one document from one customer. Your item master is never sent to the AI.

The AI reads; it never posts

  • The AI's only job is to turn a document into structured data. It has no tools and cannot write to your ERP.
  • Text inside documents is treated as data. Instructions hidden in a purchase order are ignored, and every result is checked against a strict schema.
  • Orders are posted by our code only after every blocking rule you set has passed, or after a person approves.

How the Tally connection works

  • Tally's XML interface on port 9000 has no login, so it must never be exposed to the internet.
  • The OrderDak app on your Tally PC talks to Tally on that PC only, and makes outgoing HTTPS connections to OrderDak. It does not listen for incoming connections.
  • The app uses a device key that can fetch only your company's approved orders, and you can revoke it from settings.

Every step is recorded

  • Receiving, reading, matching, every edit, approval, posting and the reply to the buyer are written to an append-only log.
  • Each entry carries a hash of the one before it, so any change or deletion breaks the chain and is detected.
  • You can export the full trail for any order. Logs are kept for at least one year.

Accounts and access

  • Sign-in with Google or Microsoft, or a one-time code by email. Two-factor authentication is required for admins.
  • Roles: owner, admin, reviewer and viewer. Rule changes are logged.
  • Data is encrypted in transit (TLS 1.2 or later) and at rest.

India's DPDP Act and GDPR

  • For your buyers' personal data (names, phone numbers, messages) you are the data fiduciary and OrderDak is your data processor, under a written data processing agreement.
  • We notify you of any personal data breach within 24 hours of becoming aware of it, so you can meet the Data Protection Board's 72-hour detailed report.
  • We delete or return your data when you leave.
  • For customers in the EU we sign an Article 28 agreement with the EU Standard Contractual Clauses.

We do not claim certifications we do not hold. SOC 2 and ISO 27001 are planned; this page will say so when they are done. Questions about security can be raised from the Enterprise plan.