---
url: https://docs.cybrosys.com/assista-x/security-and-privacy.md
description: >-
  How Assista X handles your Odoo access, credentials and data: the permission
  model, read-only default, what is stored, what goes to your AI provider, and
  retention.
---

# Security and privacy

Assista X connects as you, not around you. This page explains the permission model, what is stored, what is sent where, and how to reduce your exposure. The [privacy policy](https://x.cybrosys.com/privacy) and [terms](https://x.cybrosys.com/terms) are the full legal texts.

## Permission model

| Principle | What it means |
| :--- | :--- |
| Your own login | Assista X signs in to Odoo with the username and password you provide. You do not need to be an Odoo administrator |
| Your exact permissions | Your Odoo access rights and record rules apply to every answer. If you cannot see a record in Odoo, Assista X cannot see it |
| Access denied means stop | If Odoo denies access, Assista X reports it and stops. It does not try to reach the same data through related records, and a request to "find a workaround" is refused |
| Read-only by default | Every connection starts read-only. **Settings > General > Read Only Mode** shows **Enabled** by default |
| Write access is opt-in | If write access is enabled, the assistant can create and update records, only within what your own Odoo permissions allow |
| No deletion | Deleting and archiving records is never available, in any mode |
| Company scope | If you select companies in the server menu, queries are limited to them |

> **Tip.**
>
> The safest setup is a dedicated Odoo user with only the access you want the assistant to have, ideally read-only. The Terms and Conditions recommend a read-only Odoo user during beta.

## Data flow

```text
Your browser  <->  Assista X  <->  Your Odoo server (live queries)
                       |
                       +---->  AI provider you configured (your own API key)
```

1. You ask a question in the browser.
2. Assista X queries your Odoo server live, with your login, for the records it needs.
3. The relevant data and your question are sent to the AI provider you configured, using your own API key, to write the answer.
4. The answer comes back to you, and the conversation is saved to your account.

* Assista X never syncs or keeps a copy of your Odoo database.
* Only the data relevant to the question is sent to your AI provider.
* Your data is used to answer you. It is never sold or shared, and it is not used to train any AI model.
* Your AI provider processes that data under its own privacy policy. Review it before you connect sensitive business data.

## What Assista X stores

| Data | How it is protected |
| :--- | :--- |
| Account details (name, email) | Stored with your account |
| AI provider, model and API key | The key is stored encrypted and is not shown again |
| Odoo connection details (URL, database, username, password) | The password is stored encrypted and is not shown again. It is only used to connect to your server |
| Conversation history | Saved to your account so you can continue and revisit chats |
| Google tokens, if you connect Google | The refresh token and connected address are encrypted at rest. See [Google integration](/assista-x/integrations/) |
| Usage details | Timestamps, session identifiers and error logs, for diagnosing problems |

Traffic between your browser and Assista X is encrypted with HTTPS. Your signed-in session expires after seven days.

## Connection safeguards

* Assista X only connects to public `http` and `https` addresses. Private, loopback and link-local addresses, and `localhost`, are refused.
* Assista X signs in to your Odoo server before it saves a server, and refuses to save one that fails.
* Raw Odoo error text is explained in plain language and not shown to you as is.

## Custom addons

[Custom addons sync](/assista-x/custom-addons/) reads your module source by static parsing. Nothing is executed, and no business data or records leave your machine.

## Shared chats

A chat you share by link can be read by anyone who has the link. Revoke it from the same menu when you are done. See [Chats and sharing](/assista-x/chats-and-sharing/#share-a-chat).

## Retention

Your account data and chat history are kept for as long as your account is active. You can ask for your account and all associated data to be deleted. You can also delete a chat yourself from the sidebar. During beta, data may be reset between major releases, and you are told in advance if that happens.

## Your rights

You can ask to see the personal data held about you, to correct it, or to delete your account and data. Use the **Contact Us** option in the app. Assista X is not intended for anyone under 16.

## Beta notice

Assista X is in beta. The privacy policy states that the application has not had a full third-party security audit, and the terms ask you not to connect highly sensitive, regulated or irreplaceable data unless you accept the risks. Read-only mode is a software control, not an absolute technical guarantee, so keep independent backups and use a limited Odoo user.

## Next steps

* [Connect your Odoo server](/assista-x/connect-odoo/)
* [AI providers](/assista-x/ai-providers/)
* [FAQ](/assista-x/faq/)