Trust Center
Security you can check, not just read.
The operating posture behind Orithos — encryption, isolation, retention, subprocessors, and how to reach us when something looks wrong.
SOC 2 Type II program in progress · report under NDA when issued
Controls
How we protect your data.
Four areas where the platform does the work for you — from credential handling to the disclosure channel.
Encryption & secrets
- TLS in transit; encrypted at rest on the data plane.
- Agent credentials encrypted at rest with Fernet symmetric encryption; API keys hashed with bcrypt (cost factor 12) and shown once at creation.
- No customer credentials stored in plaintext anywhere in the platform.
Isolation & access
- Per-organisation data isolation enforced at the database layer (row-level security) with role-based access control.
- Immutable audit logging of access and configuration changes; every admin action carries an actor and reason.
- Per-route rate limiting; HttpOnly session cookies; no advertising trackers.
Retention & zero-knowledge
- Tiered retention windows (Free 14 days, Starter 90 days, Team+ 365 days; custom on Business+), export-then-purge with fail-open semantics.
- Zero-Knowledge mode: traces are never stored for orgs that enable it.
- Evidence viewing and export are never metered and never gated on billing state.
Incidents & disclosure
- Suspected platform vulnerabilities are treated as highest-priority incidents.
- Report privately to [email protected] — machine-readable policy at /.well-known/security.txt.
- Personal-data breaches: documented notification process per the DPA (§8).
Compliance
Artifacts & mappings.
Public documents and where each framework's controls are answered. SOC 2 Type II report ships under NDA once issued.
Security overviewEncryption, hashing, and platform controls in detail.Data Processing AgreementGDPR/CCPA terms, subprocessors (§6), international transfers.Business Associate AgreementHIPAA terms and audit rights.Compliance mappingsOWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, SOC 2 controls.security.txtMachine-readable vulnerability-disclosure contact.
Subprocessors
The companies we rely on.
The authoritative list, mirrored from the DPA (§6). We notify customers of intended changes at least 30 days in advance.
Infrastructure hostingDedicated virtual private servers, European Union — application, database, and cache.
Dodo PaymentsSubscription and credit-pack billing (billing contact details only).
LLM evaluation gatewayJudge-model inference (default: DeepSeek models; configurable per deployment). Probe payloads and agent responses transit this gateway at sampling temperature 0.
PostHogPseudonymised product analytics.
ResendTransactional email delivery.
SentryError diagnostics (identifiers stripped where possible).
GitHub / GoogleOAuth sign-in (email address only).
Disclosure
Report privately. We triage fast.
Found something on the platform or in a scan result you believe is wrong? Write to [email protected] — or use the machine-readable contact at /.well-known/security.txt.