Security
Security at Orbit
This page describes how Orbit is built and operated today, written to be forwarded to a security reviewer. Where a control is not yet in place, we say so rather than leave it implied. See data handling for export, retention and deletion.
Architecture and hosting
Orbit is a multi-tenant SaaS application. The application and API run on Cloudflare's edge network; customer data lives in a managed PostgreSQL database provided by Supabase, with file uploads in Supabase Storage.
All traffic is served over HTTPS with TLS. Data is encrypted at rest by the underlying managed platform.
Tenant isolation
Every customer record is scoped to a workspace (tenant) identifier. Isolation is enforced in the database itself with PostgreSQL row-level security policies, so a query can only return rows belonging to a workspace the authenticated user is a member of — not only in application code.
Server-side operations that legitimately need elevated access run only after the caller's identity and workspace membership have been verified.
Authentication and access control
Users sign in with email and password. Sessions are JWT-based and expire automatically; password reset is email-verified.
Within a workspace, members are managed under Settings → Team, and feature access is additionally governed by the workspace's subscription tier.
Not available today: SAML/OIDC single sign-on, SCIM provisioning, and enforced multi-factor authentication. SSO is on the roadmap; tell us if it is a gating requirement and we will share timing.
API keys and webhook secrets
API keys are generated client-side with a CSPRNG and shown once. Orbit stores only a SHA-256 hash plus a short non-sensitive prefix used for identification in the UI, so keys cannot be recovered from our database. Keys are workspace-scoped and revocable at any time, and last-used timestamps are recorded.
Outbound webhooks are signed with a per-endpoint secret using HMAC-SHA256 so receivers can verify authenticity. Secrets and key hashes are excluded from data exports.
Third-party integrations
Integrations such as Gmail, Calendar and Slack connect per user via OAuth. Tokens are stored server-side and are never exposed to the browser. A user can disconnect an integration at any time from the Integrations tab, which revokes Orbit's stored credentials.
AI processing
AI features send only the content needed for the requested action to our AI provider. Workspaces on a paid tier can supply their own provider API key, in which case AI requests are billed to and processed under that key.
Customer content is not used to train our models, and we do not sell customer data.
Backups and availability
The managed database platform performs automated daily backups with point-in-time recovery on supported plans. Restores are performed by us on request.
Logging and monitoring
Application and API errors are logged for operational purposes. Webhook deliveries are logged per workspace and visible to that workspace. In-app activity (feature usage, sign-in times) is recorded to power the customer's own analytics and our product metrics.
Sub-processors
We will give notice to workspace admins before adding a sub-processor that handles customer content.
Certifications
Orbit is not currently SOC 2 or ISO 27001 certified, and we make no HIPAA or PCI compliance claim. Card processing is handled entirely by Stripe, which is PCI DSS Level 1 certified; Orbit never receives card numbers.
We are happy to complete a security questionnaire and to sign a data processing agreement.
Reporting a vulnerability
Email will.blakey@me.com with a description and reproduction steps. We aim to acknowledge within two business days and will keep you updated until resolution. Please do not publicly disclose before we have had a chance to fix the issue.