Security overview
Orrin security overview
This document lists the practices Orrin is being built to and the status of each one. It says exactly what the Security page says. Orrin holds no certification today; a SOC 2 audit is planned. No customer data is processed yet.
- 01
Tenant isolation
Each vendor workspace gets its own search index, conversation logs, audit log and credentials. Nothing is shared across workspaces at any layer.
Planned - 02
Token model
The vendor’s backend mints a signed token per end user that lives between five and fifteen minutes and carries the user id, company id, role and scopes. The widget sends it with every request. Orrin never holds a shared service account for end user actions.
Planned - 03
Confirmation model
Every Write action shows a preview and waits for the user’s Confirm. Sensitive actions require a typed word. The confirmation is bound to the exact action, inputs, user and tenant, and permission is checked again immediately before execution.
Planned - 04
Audit log
User, company, tool, parameters, the preview shown, the confirmation, the API response and the timestamp are written for every action and kept in the vendor’s isolated log.
Planned - 05
Encryption in transit and at rest
All traffic uses TLS. Stored documents, indexes and logs are encrypted at rest by the hosting providers named below.
Planned - 06
Retention and deletion
Deleting a document removes its chunks from the index within minutes. Conversation and audit logs follow a retention period set per workspace.
Planned - 07
Prompt injection defenses
Retrieved documents and API responses are treated as data, never as instructions. Tools come only from the vendor’s allowlist. Every write still requires the user’s confirmation.
Planned - 08
No training on customer data
Customer documents and conversations are never used to train models.
Planned - 09
Subprocessors
This website is hosted on Vercel. The runtime providers for models, search and storage will be named here before any customer data is processed, and every workspace will be told before a subprocessor changes.
In use - 10
Incident contact
Security reports go to the security mailbox published on this page. Affected workspaces are told within seventy two hours of a confirmed incident.
Planned - 11
SOC 2
A SOC 2 audit is planned. Orrin does not hold SOC 2 or any other certification today.
Planned
Contact: the security mailbox is published on the Security page before the first production workspace opens.