Security

Security at Orbitable

We take the security of your data and GTM intelligence seriously. Here's what we do to protect it.

🔒Data Protection

The public service uses HTTPS for encrypted connections
Connected-account credentials use application-level AES-256-GCM encryption when the deployment encryption key is configured; TikTok connections require that key
Database encryption and backup retention depend on the hosting provider and deployment configuration. Contact us for the controls applicable to your deployment

Customer records are held in shared database tables and scoped to a workspace identifier, with access checks in the application
Workspace membership and roles determine which customer worlds and actions a user can access
Workspace files are organised by tenant and customer world
Usage allowances and API rate limits are enforced at workspace level

Clerk handles sign-in and session management; Orbitable does not store account passwords
Protected routes validate the signed-in user and their workspace access
Connected services use their supported OAuth or API-key authentication

Relevant prompts and business context are sent to the AI providers used by the selected feature
Anthropic and OpenAI process agent requests under their API terms; provider retention and data-use terms apply
Generated outputs are stored with workspace and customer-world context
Connecting a third-party service allows Orbitable to exchange the information needed for the actions you request

Credentials for connected services (API keys and sign-in tokens) are encrypted with AES-256-GCM before they are stored. A production deployment refuses to save one if the encryption key is not configured
Encryption keys carry an identifier, so a key can be rotated and stored values re-encrypted under the new one
A credential is decrypted only at the moment of a call. It is never returned by our API, never placed in a prompt, and is removed from log lines
A server address you add is checked before it is used: https only, public addresses only, no internal networks, and every redirect is checked again
A tool is off until a person has reviewed it. If a tool’s name, description or inputs change after review, it is switched off again until it is reviewed again
Results from a connected service are labelled as external data and capped in size before an agent sees them

A tool that changes data or spends money never runs because an agent asked. Each call is shown to a person to approve, edit or decline first, unless an owner or admin has set that specific reviewed tool to approve automatically. Where this has not been switched on, agents cannot make those calls at all
Only owners and admins can enable a tool that changes data, switch on automatic approval, or view and export the call record
Every external call made through a connection is recorded: the tool, workspace and customer world, who or what started it, the time, the outcome, how long it took, the size of the result, and a short summary of the arguments. Calls we refuse are recorded with the reason
The record never contains the credential or the full result. Secrets in the summary are removed, and the summary is cut to 500 characters
The record is kept for 400 days
If a connection stops working, for example because its sign-in was revoked, the workspace owner is emailed once and the connection is marked as needing sign-in

Replit hosts the application and Neon provides the PostgreSQL database
Stripe handles payment details; Orbitable stores billing references and subscription status rather than card numbers
Clerk provides authentication and Resend delivers transactional email
Additional providers may process data for the integrations and creative features you use

Orbitable has not achieved SOC 2 Type II or ISO 27001 certification
Contact us to discuss data processing, deployment controls and your security review requirements

Have security questions?