Your Odoo credentials
Encrypted before storage
Every credential is encrypted the moment you submit it, using AES-128-CBC with HMAC-SHA256 authentication. Nothing is written in plaintext.
Never readable back
Once saved, a credential cannot be retrieved — not through the API, not through the interface, not by you. Only whether one exists.
Separate keys per system
Odoo credentials, GitHub authorizations and two-factor secrets are each encrypted under their own key, so one does not expose the others.
Decrypted only in use
A credential is decrypted only when a task you started needs it, and only for that turn.
You set the ceiling
Every Odoo connection carries an access level that you choose:
A task can be given less access than the connection allows, never more — a request to escalate is clamped back down on our side, not trusted from the browser. And even at Write or Delete, destructive operations still stop and ask you before they run.
Your work is isolated
Every task runs in its own container, with its own storage, created for that task and destroyed with it. One task cannot see another’s workspace.Nothing is used to train models
Your code, your prompts, your business data and your credentials are never used to train, fine-tune or evaluate any model — ours or anyone else’s. Third-party providers that run model inference are bound by agreements that prohibit it.Nothing reaches production without you
CodeCobra cannot push to production on its own. Every change goes through a plan you approve and a pull request you merge, and production merges are gated separately from staging. You also get a disposable Odoo instance to test the change against before any of that.Review and deploy
How changes get from a chat to your production system.
Account security
Two-factor authentication
Authenticator app, backup codes and trusted devices.
Require 2FA for your team
Organization owners can make it mandatory.
Data retention
How long we keep things
Idle workspaces are purged after 90 days, and deleting a task destroys it properly.