Open-source intelligence, assembled into evidence.

ODIAN gathers information from public and licensed sources, records where every finding came from, and delivers cited reports to your organization's authorized users. Case records and reports are encrypted under a key dedicated to your organization, and case actions are recorded in a tamper-evident audit trail.

Request a briefing See our security controls

GATHER · VERIFY · PROTECT · DELIVER

Intelligence

Public RecordsRegistries, filings and official records, worldwide where available.

Online PresenceSocial media, forums and news, gathered and sourced.

ConnectionsCompanies, ownership and associations, mapped.

Vehicles & AircraftVIN and aircraft tail-number lookups.

Protection

AES-256 EncryptionCase records and reports, under a key dedicated to your organization.

Tamper-Evident AuditCase actions and data disposals on a hash-chained record.

Client SeparationEnforced in the database, with a dedicated database for enterprise clients.

Multi-Factor Sign-InAuthenticator app enrolled before any data can be reached.

Sourced FindingsEvery finding names where it came from.

Staff-Released ReportsDelivered to you by Global Traveler staff.

AI SafeguardsU.S.-based AI. Sensitive identifiers screened.

Tested RecoveryEncrypted daily backups, weekly restore tests.

TURNING PUBLIC DATA INTO SOURCED, SECURE EVIDENCE

AES-256-GCMCase records and reports, a key per client organization

MFAAuthenticator app enrolled before any data access

Hash-chainedTamper-evident audit trail

ZeroInbound connections from the public internet to our application servers

DB-enforcedClient separation in the database

WeeklyAutomated database restore tests

How it works

From a name to a decision, in three steps

Open a case

Tell us who or what you need to understand, for a lawful due-diligence purpose: a person, a company, a vehicle or an aircraft. Your case records are encrypted at rest under a key dedicated to your organization.

ODIAN gathers and verifies

ODIAN researches public and licensed sources worldwide. Sources receive only the search terms or media needed for each lookup, never your case file, and never learn who the client is.

You receive the evidence

A decision-ready report: what we found, where it came from, what it means for your risk, and what to do next, released to you by Global Traveler staff.

What you receive

A report built for the decision, not the data dump

Executive summary. The bottom line, up front.
Risk overview. Findings ranked by how much they matter.
Findings register. Every finding listed with its source.
Recommended next steps. What to verify, ask or act on.
Methodology and sources. How the work was done and where every fact came from.

DUE DILIGENCE REPORTILLUSTRATIVE

Undisclosed prior company dissolved

Source: state business registry

HIGH

Company address differs between filings

Source: public registries · 2 corroborating

MEDIUM

Professional license active, no actions

Source: licensing board

LOW

Next step: request dissolution records directly from the subject.

Security & audit

Your case material is protected at every layer

Investigations involve sensitive information about real people. ODIAN was engineered around that fact: application-level encryption under a key dedicated to your organization, separation enforced in the database, and a tamper-evident record of what happens on your case.

Encryption at rest

Case records, generated reports, analyst drafts and published client reports are encrypted with AES-256-GCM at the application layer.
Each client organization's data is encrypted under its own key, generated by the platform and protected by a master key on restricted-access servers.
If encryption of a generated report fails, the plaintext is deleted and the report is withheld; publishing a client report is refused if it cannot be encrypted.
Data volumes, managed databases and offsite backups also use our hosting provider's encryption at rest.

Encryption in transit

Connections are encrypted with TLS, and browsers are told to always use HTTPS (HSTS).
Client web traffic reaches our application servers through an authenticated, encrypted tunnel.
All database connections are TLS-encrypted.
Offsite backups are encrypted before they leave our servers.

Tamper-evident audit trail

Case actions, data disposals and AI-safety findings are written to a hash-chained audit log.
Each entry is chained by hash to the one before it, and the chain checks are covered by automated tests.
Sign-in attempts and sessions are recorded in a separate database log.
The audit trail never contains user passwords or authentication secrets.

Sourced evidence

Every finding carries its source, so the chain from evidence to conclusion stays visible.
Each report includes its methodology and a list of sources.
Reports are released to clients only by Global Traveler staff.

Client separation

Account and organization data in the database is separated by Postgres FORCE row-level security; case files are separated by server-side ownership checks.
The application's database role cannot read any client's rows without a client context.
An automated weekly probe verifies that role cannot bypass client isolation; failures raise an alert.
A physically separate database is available for enterprise clients.

Identity & access

Authenticator-app multi-factor sign-in must be enrolled before any data can be accessed; API access uses revocable tokens.
Passwords are stored only as Argon2id hashes; never readable, never reversible.
Lockout and throttling against password guessing; 30-minute idle timeout.
You are emailed whenever multi-factor settings on your account change.

Closed network

Application servers accept no inbound connections from the public internet; a default-deny firewall admits only our private admin network, confirmed by external port probes.
Client web traffic passes DDoS protection at the network edge first.
Administrative access uses key-based authentication over a private network; password login is disabled.
Fetches of user- or case-supplied web addresses are checked against private, internal and cloud-metadata address ranges, including on every redirect.

AI safeguards

ODIAN's AI runs on Anthropic's commercial API, whose terms exclude customer content from model training, with processing kept in the United States.
Every AI request the platform makes passes through one security checkpoint.
That checkpoint looks for sensitive details, such as Social Security numbers, card numbers and passwords, before anything is sent to an AI model.
Web content is screened for hidden instructions and suspicious content is isolated as data; an emergency stop can halt AI analysis platform-wide.

Retention & disposal

Data is stored in the United States.
Case files are kept for 365 days from the start of the engagement, then deleted by a weekly scheduled job.
Each deletion is recorded in the tamper-evident audit log.
Cases can be placed on legal hold.

Verified, not asserted

Our controls run on a schedule, and every run leaves evidence

DailyEncrypted offsite backups

Stored in the United States, checksum-verified, with an automatic alert if a backup is late.

WeeklyDatabase restore tests

An automated restore proves our database backups can actually be restored.

WeeklyClient-isolation probe

Verifies the application's database role cannot bypass client isolation; failures alert.

DailyDependency scans

Production software dependencies are checked against public vulnerability databases.

Every changeAutomated test gate

Every change must pass a test suite, including encryption, audit-chain and AI-safety tests, before it can be merged and deployed.

PeriodicInternal security reviews

Structured attempts to find weaknesses, with findings tracked and fixes re-verified.

Our security, data protection and compliance overview is available to prospective clients under NDA.

Facts & Q&A

Questions clients ask us

About ODIAN

What is ODIAN?

ODIAN is an intelligence system developed and operated by Global Traveler LLC. It researches public and licensed sources about a subject, records where each finding came from, and assembles the cited results into a report for your authorized use.

Who is ODIAN for?

Corporations, law firms, government agencies, financial institutions and private clients conducting authorized investigations and due diligence for a lawful purpose.

What can I ask ODIAN to look into?

People: background, online presence, business connections and public records.
Companies: registrations, ownership, history and reputation.
Vehicles: starting from a VIN.
Aircraft: starting from a tail number.

Where does the information come from?

ODIAN draws on a broad range of public and licensed data sources worldwide. Every finding in your report names its source. Sources receive only the search terms or media needed for each lookup; they never receive your case file and never learn who the client is.

What exactly do I receive?

A decision-ready due diligence report: an executive summary, a risk overview, a register of findings with their sources, recommended next steps, and the methodology and sources used. Reports are released to you by Global Traveler staff.

Security, encryption & audit

Is my data encrypted?

Yes. Case records, generated reports, analyst drafts and published client reports are encrypted with AES-256-GCM at the application layer, under a key dedicated to your organization. Data volumes, managed databases and offsite backups also use our hosting provider's encryption at rest. Connections are encrypted with TLS, and offsite backups are encrypted before they leave our servers.

Who holds the encryption keys?

The platform generates a dedicated key for each client organization and protects it with a master key held on restricted-access servers. Detailed key-management information is available to prospective clients under NDA.

Can anyone change the record of what happened on my case?

Case actions, data disposals and AI-safety findings are written to an audit log in which every entry is chained by hash to the one before it. The chain checks are covered by automated tests, and the audit trail never contains user passwords or authentication secrets.

How is my data kept separate from other clients?

Account and organization data is separated by the database itself, using Postgres row-level security, and case files are separated by server-side ownership checks. Each client organization also has its own encryption key, and an automated weekly probe verifies the application's database role cannot bypass client isolation. Enterprise clients can have a physically separate database.

Who at Global Traveler can see my case?

Your organization's authorized users, and authorized Global Traveler staff working on your engagement. Administrator sign-ins are recorded, and administrative case and report actions are attributed to the person who took them.

Do you use AI with my data? Is it used for training?

ODIAN uses AI to analyze findings. Every request goes through one security checkpoint to Anthropic's commercial API, whose terms exclude customer content from model training, with processing kept in the United States. That checkpoint looks for sensitive details, such as Social Security numbers, card numbers and passwords, and scans web content for hidden instructions meant to trick the AI.

Where is my data stored, and for how long?

In the United States. Case files are kept for 365 days from the start of your engagement and then deleted by a weekly scheduled job, with every deletion recorded in the tamper-evident audit log. Cases can be placed on legal hold.

What happens if there is a security incident?

We follow a written incident response plan that is reviewed annually and after every incident. Notifications follow applicable contractual and legal requirements, including any timeframe agreed in your contract.

Do you sell client data?

No. We never sell client data. Your case material and reports belong to you, and we use them only to deliver the service. Service providers that help us deliver it receive only the data they need.

Can we review your security documentation?

Yes. Our security, data protection and compliance overview is available to prospective clients under NDA. Contact support@globaltravelerllc.com.

How do I report a vulnerability?

Email support@globaltravelerllc.com with the steps to reproduce. We do not pursue good-faith researchers who respect client data and avoid disrupting the service.

Getting started

How do I get started?

Email support@globaltravelerllc.com or contact us to request a briefing. Existing clients can sign in at odian.io.

Get started

See what ODIAN finds before your next decision.

Request a briefing and we'll walk you through a sample report and our security controls.

Request a briefing Client sign-in Also from ODIAN: Shield Services