01
Isolation per request
Every scoped route checks the tenant on the credential against the tenant on the resource. A mismatch is rejected outright rather than filtered from a result set.
Security & trust
One deployment, many customers, no shared blast radius.
If you resell nutrition to your own customers, their data cannot mix. Isolation is enforced on the request path rather than applied as a filter after the query has already run.
Tenancy model
What isolation actually means here.
Each of your customers is a separate tenant with its own credentials, catalog and users.
Tenant A
Own keys · own catalog · own users
Profiles
Plans & logs
Catalog
Tenant B
Own keys · own catalog · own users
Profiles
Plans & logs
Catalog
Tenant C
Own keys · own catalog · own users
Profiles
Plans & logs
Catalog
403
A credential scoped to one tenant cannot read or write another tenant’s data. Cross-tenant access is rejected on every scoped route, not filtered after the fact.
Roles within a tenant
tenant_readonly
Read scoped data
tenant_operator
Run day-to-day operations
tenant_admin
Manage keys and configuration
Platform controls
What your security review will ask about.
02
Keys you can rotate
API keys are stored as hashes, never in plaintext, and are shown once at creation. Create, list and revoke are all API operations, so rotation can be automated.
03
Roles with real separation
Read-only, operator and admin roles inside a tenant, kept distinct from platform administration, so elevated actions have to be deliberate.
04
Your identity provider
Tenant sign-in supports OIDC with PKCE and SAML, so your users authenticate against your directory rather than a second set of credentials.
05
Signed webhooks
Outbound events are HMAC signed so your backend can verify a payload came from ONE before acting on it.
06
Traceable requests
Every response carries a request identifier. Quote it and we can follow a single call through the system.
Data handling
Where your data lives and how long it stays.
Nutrition data is personal data. The platform is built on the assumption that you will be asked to prove what happens to it.
Region pinning
A tenant is pinned to a deployment region, and requests that would move its data outside that region are refused.
Subject requests
Export and erasure for an individual end user are supported as operations, so you can answer a data subject request without a manual database job.
Retention
Retention windows are configurable per tenant rather than fixed by the platform.
Honest boundaries
What we will not claim.
Security pages are easy to write and hard to honour. These are the things we would rather tell you now than during your risk review.
Certifications and SLAs are scoped per contract
Formal certification, DPAs, penetration test evidence and SLA terms are handled through OSCA Solutions as part of your engagement. Tell us what your risk process needs and we will tell you what we can currently evidence.
ONE is not a medical device
It does not diagnose conditions, prescribe treatment or provide clinical advice. If your product operates in a regulated clinical context, the regulatory responsibility sits with your product, and we will work within the boundaries you set.
Build personalised nutrition into your product.
Talk to the ONE by OSCA team about how personalised nutrition can fit your product roadmap — and how optional wearable data context can extend it when needed.
Product teams book a demo · Engineering teams explore the API and SDKs