1. The short version

Read-only. Narada only ever reads your data — it never writes to your ERP or systems.
Encrypted. Data is encrypted in transit (TLS/HTTPS) and at rest; ERP credentials are encrypted and integration connections are SSRF-guarded.
Isolated. Each customer’s data is segregated per tenant with row-level security.
Human-verified. A person reviews your first run before any figure is shown to you, and you approve before Narada acts on anything.
Checkable. Every figure carries its formula and a query to verify it in your own ERP — nothing is fabricated, and nothing is silently dropped.

2. How you connect (all read-only)

File upload — drop a single export or a zipped export folder; large files are split and reassembled automatically.
Email-drop — your ERP emails its scheduled export to a private, per-tenant address; ingested automatically, no manual step.
Odoo — a native, read-only API connection; credentials encrypted at rest, scoped to read access, SSRF-guarded. Other ERP integrations on request.

We never receive write access, and we cannot change anything in your systems.

3. Infrastructure & access

Hosted on Railway (United States); encryption in transit and at rest.
One operator, named. Narada is run by a single founder-operator. There is no support team, no contractors and no third-party staff with access to Client Data — so “who could look at my data?” has exactly one answer, and he is bound by the confidentiality obligations in these terms.
Administrative tooling is reachable only with a separate secret admin key held by that operator — it is not a customer login and it is not shared. We do not claim multi-factor authentication on internal tooling today; when that changes, this page changes with it.
Tenant isolation enforced at the database layer (row-level security); cross-tenant access attempts are rejected. Application access requires a per-tenant API key, stored hashed.
Backups are the encrypted, same-region point-in-time backups provided by our host (Railway), on a limited retention window, and are covered by the same deletion commitments as live data.
Payments are handled entirely by Dodo Payments, a PCI DSS Level 1 merchant of record; Narada never sees or stores full card numbers.

4. Data integrity (why one wrong number never reaches you)

Before any figure is shown, your data passes a multi-gate trust layer: file/contract checks, row validation with quarantine of bad rows, statistical screening of outliers, and per-calculation sufficiency gates that skip loudly rather than guess. Excluded rows are counted and explained, never silently dropped. An operator reviews the first run before activation.

5. Data Processing terms

For the operational data you connect (“Client Data”), you are the controller and Narada is the processor. We process Client Data only to provide the Service and only on your documented instructions. Specifically we:

process Client Data solely to deliver the Service to you, never to sell it or to train shared/third-party models;
impose confidentiality on personnel with access;
engage sub-processors only under equivalent data-protection terms (list available on request);
assist you with data-subject requests and, where applicable, with security and breach obligations;
return or delete Client Data on termination, per the Privacy Policy.

A signable Data Processing Addendum (DPA) is available for customers who require one — contact security@naradaos.com.

6. Breach notification

If we become aware of a personal-data breach affecting your data, we will notify affected customers without undue delay — and, where feasible, within 72 hours of becoming aware — with the information you need to meet your own obligations.

7. Reporting a vulnerability

Found a security issue? Please email security@naradaos.com. We welcome responsible disclosure and will work with you to resolve it.