Trust & authority

Observable infrastructure, clear boundaries

ODINID is a non-custodial verification and commerce workflow layer. It helps users authenticate, helps merchants present direct payment instructions, and exposes selected system posture without taking custody of user funds.

Public claim: ODINID informs, verifies, records, and routes. ODINID does not hold user private keys, custody customer funds, or act as the party receiving or settling customer payments. User-initiated transactions are signed by user wallets; cooperative-operated infrastructure uses separate operator controls.

Live statusNon-intermediary statement
Identity Proof

VerusID login

ODINID uses passwordless VerusID challenge-response login. Users sign locally with their own wallet; ODINID verifies the proof and does not store passwords, seed phrases, or private keys.

  • No password database
  • No browser-supplied identity trust
  • Gateway challenge verification before Odoo session handoff
Commerce Proof

Merchant-controlled payment rails

ODINID can display checkout instructions and evidence states, but merchant payment rails remain merchant controlled. SEPA/EPC instructions point to the merchant account, and ODINID does not receive, pool, or control customer or merchant funds.

  • No merchant-of-record role
  • No pooled customer funds
  • No ODINID-controlled default settlement account
System Proof

Fail-closed operations

Operational routes are separated by purpose. Public pages are read-only, member actions require VerusID session context, and internal render/RPC surfaces require configured API keys, least-privilege access, and audit-friendly logging.

  • Legacy auth_verus direct login disabled
  • WEV render and frontend connector APIs are key-gated
  • Status surfaces expose selected posture without exposing keys or funds
Odoo Boundary

ODINID uses Odoo for shop, portal, order, consent, and business workflow records. Odoo does not hold wallet private keys, does not custody funds, and is not the source of on-chain truth.

  • Odoo is the administrative workflow layer.
  • Gateway and verifier logic remain the security boundary for identity proof.
  • On-chain verification remains external to Odoo business records.
Access Matrix
  • Public read-only: Trust, FAQ, legal pages, public shop pages, verified claim directory.
  • Member gated: My portal, order history, voting, member-specific actions.
  • Machine gated: WEV render, internal RPC, provisioning and signed webhooks.
  • Operator only: Bridge diagnostics, Odoo backend, internal docs and maintenance tools.

Operator-only diagnostics are separated from the public internet and are intended to be reachable only through a private operator network, combined with service-specific credentials, least-privilege access, and audit logging.

Responsible Disclosure

If you believe you found a vulnerability, contact us privately. Do not publish exploit details before we have had time to assess and remediate the issue.