Trust Center
Trust, explained
Your data lives in your own Odoo environment. We do not host it, we never train on it, and nothing happens to your personal data with AI without your consent. Newway is the only Odoo partner holding both ISO 27001 and NEN 7510. Here you can read what that means in practice, without jargon.
ISO 27001NEN 7510GDPR
Three principles
Your data stays your data
The environment is yours, the content is yours. We work in it under a data processing agreement.
AI can never do more than the person using it
Our AI works in your Odoo with the permissions of our employee, never with permissions of its own. The deeper we go into your system, the stricter the rules.
Demonstrable, not just promised
Certifications, annual audits, a signed AI addendum and documented agreements. Request our documents and check for yourself.
Certifications
- ISO 27001: information security, audited externally every year by TÜV NORD
- NEN 7510: information security in healthcare, audited externally every year by TÜV NORD
- GDPR: data processing agreement as standard, public list of sub-processors, AI addendum
- ISO 42001 (AI management system): preparing for certification, expected in 2027
AI and your data
In your Odoo, our AI can never do more than the employee using it. The deeper we go into your system, the stricter the rules and the closer our technical team watches.
Three ways we use AI
| What | How | Safeguard |
|---|---|---|
| Asking questions and looking things up | An employee consults your Odoo with AI through a secured connection (MCP) | The connection uses that employee's personal user account and permissions. Whatever they are not allowed to do, the AI is not allowed to do either. |
| Building and developing | We build custom work with AI on a development environment | Without real personal data. Nothing goes live without review by a human and our test and release process. |
| Technical analysis | Looking deep into code, logs or the database | Only on request, supervised by our technical team, preferably on a test environment. Nothing is changed on your live environment in the process. |
Is data from one analysis used for anything else?
No. There is no central AI knowledge base where customer data accumulates. Environments of different customers are technically separated, with their own keys and their own project folders. Our AI providers do not train on your data; that is laid down in our contracts.
Which AI do we use?
Mainly Claude (Anthropic), occasionally GPT (OpenAI), and for decisions in workflows possibly Jev (TypeSafe AI), only per project and after your consent. Always through business accounts with a data processing agreement.
What never goes through AI?
- Health data and other special categories of personal data, unless we agree otherwise with you in writing, case by case.
- Real personal data in development and test work. We build and test with fictitious or anonymised data.
You decide
In the AI addendum to our data processing agreement you choose: agreed, agreed without personal data, or no AI. If you want to work with AI in your Odoo yourself, we set that up with the permissions your people already have.
Security
Concrete measures, grouped the way you look for them. Every line traces back to our certified management system; we share the details on request.
Your environment and access
- Role-based access with an authorisation matrix, reviewed periodically
- Every employee has their own account, no shared passwords, password manager and MFA mandatory
- Separate keys per customer project; a key for one project does not fit another
- Access is revoked when someone leaves the company or the project
Data
- Encrypted in transit (TLS 1.2 or higher) and on our workstations (disk encryption mandatory)
- Information classification determines what is allowed where
- Retention periods documented; data is deleted when the period or the collaboration ends
- Development and testing without real personal data
AI
- AI works with the employee's permissions, never with its own or broader permissions
- Building happens on a development environment; to live only after review by a human
- Deep technical analysis only on request and supervised by our technical team
- Providers contractually bound: no training on your data
- Your choice laid down in a signed AI addendum
Organisation
- Annual external audits for ISO 27001 and NEN 7510
- Internal audits and management reviews on a fixed cycle
- Incident process with assessment of the 72-hour notification duty and notification to you under the data processing agreement
- Continuity plans, tested periodically
- Providers assessed before onboarding and periodically thereafter
- Employees trained in secure working and in safe use of AI
Where your data is stored
Your Odoo runs in Belgium and everything we host ourselves runs in Amsterdam. Only the AI model and the meeting notes run in the United States.
Per system: what it does, where the data is, who runs it, and where you can check their security yourself.
| System | What it does | Location | Run by | Security and trust |
|---|---|---|---|---|
| Your Odoo | Your ERP: sales, stock, purchasing, finance and everything else you run in Odoo. Our AI reads it through the MCP connection, with the permissions of the employee using it. Nothing from it is copied anywhere else, unless someone writes it down. | Odoo.sh on Google Cloud, Belgium (EU) | Odoo S.A., under your own contract | Odoo security, Odoo Cloud SLA, Google Cloud Trust Center |
| Second brain (knowledge vault) | A shared set of plain text notes about how your organisation works: processes, decisions, systems and agreements. It gives the AI the right context, so answers fit your situation. The sync server keeps everyone's notes in step and decides who may see which folder. | baalda.newway.nl, Amsterdam, the Netherlands | Newway, on our own server | Baalda security (the software), TransIP certifications (the data centre) |
| Attachments in the second brain | Images, PDFs and Office files that belong to the notes. Stored in our own S3 object storage, with a separate bucket and key per application. | s3.newway.nl, Amsterdam, the Netherlands (same server) | Newway | Garage (the open-source storage software), TransIP certifications |
| Process navigator | The interactive map of your processes from our analysis. Each customer has its own address and access code. | navigator.newway.nl, Amsterdam, the Netherlands (same server) | Newway | TransIP certifications |
| Change requests | Where your change requests are worked out, from intake to functional design and your approval. | requirements.newway.nl, Amsterdam, the Netherlands (same server) | Newway | TransIP certifications |
| AI model | Claude reads the question and the context the employee chose, and writes the answer. Prompts go straight from the workstation; Newway is not in between and keeps no log. Not used for training. | United States | Anthropic, business account | Anthropic Trust Center |
| Meeting notes | Records and transcribes the meetings Newway joins, so we can write accurate minutes. Only what someone writes into a note ends up in the second brain. | United States (storage on AWS, processing on Google Cloud) | Fireflies | Fireflies Trust Center, Fireflies on data storage |
The second brain is not end-to-end encrypted on the server. Access is set per folder, and someone without access never receives the files. That is why health data and other special categories of personal data never go into it.
Sub-processors and documents
Parties that may process data on our behalf. We announce a new AI party at least thirty days in advance, so you can object.
| Sub-processor | Country | Purpose | Safeguards | Trust center |
|---|---|---|---|---|
| Anthropic (Claude) | US, with a European entity | AI model for questions, analysis and development work | Business subscription, data processing agreement, no training on customer data, transfers based on the DPF or SCCs | trust.anthropic.com |
| OpenAI (GPT) | US, with a European entity | AI model, occasionally alongside Claude | Same | trust.openai.com |
| TypeSafe AI (Jev) | US | Decisions in workflows and integrations | Only after a signed data processing agreement with SCCs or the DPF, per project with your consent | No public trust center; documents on request via typesafe.ai |
| Fireflies | US | Recording and transcribing the meetings Newway joins, for accurate minutes | Business account; storage on AWS and processing on Google Cloud, both in the US | trust.fireflies.ai |
| TransIP | Netherlands | Hosting of our own server for the second brain, attachments, navigator and change requests | Data centre in Amsterdam; the server is managed by Newway and checked every month | TransIP certifications |
Your Odoo environment runs on Odoo.sh under your own agreement with Odoo; that is why it is not in this list.
Documents on request
- Data processing agreement and AI addendum
- ISO 27001 and NEN 7510 certificates
- AI policy: summary for customers
Request them via security@newway.nl, under NDA where needed.
Data processing agreement and AI addendum
With a short AI addendum to our data processing agreement, you lay down how we use AI with your data and what you choose. You sign it digitally through the customer portal.
What it covers
- The three ways we use AI, with the safeguards for each
- Which AI parties are involved, and that we announce a new party at least thirty days in advance
- On which legal basis data goes to the US (EU-US Data Privacy Framework or standard contractual clauses)
- That we develop and test without real personal data
- How we set up an AI connection for your own employees, if you want one
Your choice
- Agreed
- Agreed without personal data
- No AI
- Work with AI yourself too: a connection for your own power users
Frequently asked questions
AI and data
Can Newway's AI simply enter our environment?
No. The AI works with our employee's user account and permissions, and touches your personal data only if you have allowed that in the AI addendum.
Is our data used to train AI models?
No. Our contracts with the AI providers rule out training on customer data.
Can AI reach data of other customers?
No. Every customer has their own keys and their own separated project environment.
Do you test with real personal data?
No. We develop and test with fictitious or anonymised data.
Can we refuse the use of AI?
Yes, always. In the AI addendum, choose no AI, or AI without personal data.
Does AI change anything in our live environment?
Only within the permissions of the employee using it, just like that employee. Custom work always goes through a development environment, review by a human and our release process. During deep technical analysis, nothing is changed on your live environment.
Can our own employees work with AI in Odoo too?
Yes. We set up a connection for your power users, with the permissions they already have, and advise on safe use.
Compliance
Which certifications does Newway hold?
ISO 27001 and NEN 7510, both audited externally every year by TÜV NORD. We are the only Odoo partner with both. ISO 42001 for our AI management system is in preparation, with certification expected in 2027.
What about the GDPR?
Data processing agreement as standard, AI addendum, public list of sub-processors and a notification process for data breaches.
Does Newway comply with the EU AI Act?
We run an AI literacy programme (Article 4) and our AI policy governs transparency and human oversight. We are preparing for ISO 42001 certification, expected in 2027.
Where is our data?
In your own Odoo environment on Odoo.sh (Google Cloud, Belgium), under your contract with Odoo. If we run a second brain for you, it is stored on our own server in Amsterdam. See where your data is stored.
Way of working
Who can access our environment?
Only employees working on your project, according to an authorisation matrix.
What happens in case of an incident?
Investigate, contain, inform you under the data processing agreement and, in case of a data breach, assess notification to the supervisory authority within 72 hours.
Questions about security or privacy? Email security@newway.nl. You will get an answer from a human.
