Bifrost Privacy Notice

Who we are

Bifrost is a product of Odingard Security. Odingard Security operates the hosted Bifrost service and is the controller of account information described below. For evidence and other content a company publishes through Bifrost, that company is the controller and Odingard Security processes it on the company's instructions.

Information we process

Account information: name, work email address and role for people who administer a company's Bifrost workspace, and sign-in records for one-time codes, passkeys and enterprise single sign-on.

Reviewer information: the work email address a buyer's reviewer verifies, agreement (NDA) acceptance records, and access requests and grants.

Customer content: documents, evidence and settings a company uploads, along with the questions asked of it, the answers Bifrost returns, their source citations and their signed receipts.

Field captures: when a company uses verified physical work, the photos, sensor readings and device-reported time and location that its enrolled devices sign.

Security records: an append-only audit log of access, answers and administrative actions.

The Bifrost MCP connector

The shared Bifrost MCP endpoint lets an AI assistant find companies that have chosen to list their trust center, read their public trust profile and ask questions answered only from their public evidence. Companies are not listed unless they turn listing on.

We do not store the IP address or identity of the person using the assistant. A question asked through the connector is recorded in the listed company's audit log, the same way a question asked on its public trust page is.

When an assistant requests a company that is not on Bifrost, we record only the company's domain, the name supplied and how many times it was requested. Bifrost does not email anyone as a result of a connector request.

How we use information

We use information to operate Bifrost: to authenticate users and agents, enforce each company's disclosure policy, answer questions from cited evidence, issue and verify receipts, keep the audit log, provide support and secure the service. We do not sell personal information, and we do not use customer content to train AI models.

Service providers

Google Cloud hosts the service in the United States and runs the AI models through Vertex AI. Resend delivers sign-in and notification email, and Stripe processes payments. Companies that run Bifrost in their own isolated deployment keep their content and models inside their own environment.

Security

Each company's data is isolated with row-level security and its own encryption keys, and customer-managed keys are supported. Agent credentials are bound to the sender (DPoP), restricted material requires approval, and every answer and approved action carries a signed receipt.

Retention

Documents are kept until the company deletes them. Superseded versions are kept for 12 months, and deleted documents are purged after 30 days. Reviewer personal information is kept for 24 months after last activity. Answers, receipts and audit events are kept for 7 years for their evidentiary value. When a company deletes its workspace, its data is purged within 30 days and its keys are destroyed.

Your choices and rights

You can ask us to access, correct or delete your personal information by emailing [email protected]. If your information is in a company's workspace, we will work with that company to respond. Erasure replaces your personal information in audit records with a pseudonymous identifier so the record stays verifiable.

Contact

Odingard Security, [email protected].