Security at Orchexa

01Infrastructure

• Hosted on Tier-1 cloud regions in APAC with isolated production VPCs.
• Infrastructure-as-Code (Terraform) with peer-reviewed pull requests; no manual console changes in production.
• Hardened images, automatic OS patching, and continuous baseline drift detection.
• Database snapshots every 6 hours, encrypted, retained 35 days, with regular restore drills.

02Encryption

• TLS 1.2+ for all customer traffic; HSTS preload on orchexa.io.
• AES-256 at rest for databases, object storage, and backups.
• Per-tenant encryption keys for sensitive fields (integration credentials, API keys, voice recordings).
• Secrets stored in a managed KMS; never in source code or logs.

03Identity and access

• Role-based access control (Owner / Admin / Member) on every tier.
• SSO via Google and Microsoft OIDC on Business and Enterprise; SAML on Enterprise.
• Granular per-resource RBAC on Enterprise.
• MFA required for all Orchexa staff. Production access is just-in-time, time-bound, and audited.
• API keys are scoped, rotatable, and viewable once at creation.

04Tenant isolation

• Logical isolation enforced at every query: tenant_id is required and validated at the data layer, not just the application layer.
• LLM and voice inference calls carry no cross-tenant context; system prompts are tenant-scoped.
• Knowledge base RAG is partitioned by tenant; cross-tenant retrieval is impossible by construction.

05Application security

• All code changes go through peer review and automated CI checks.
• Static analysis, dependency vulnerability scanning, and secret scanning run on every pull request.
• OWASP Top 10 mitigations baked into the framework: parameterized queries, content security policy, CSRF tokens, output encoding.
• Annual third-party penetration test on Business and Enterprise scope; report available under NDA.

06AI and LLM security

• Prompt-injection defenses are baseline on every tier (regex + classifier + tool-call gating).
• PII output redaction (advanced guardrails) is included on Growth and above.
• Tool-call allow-lists per agent: the agent cannot call tools you have not explicitly enabled.
• Voice and chat outputs are not used to train shared or third-party models. Enterprise inference paths can be pinned to specific regions or providers.
• Conversation logging is opt-in at the agent level; voice recording is off by default.

07Logging and monitoring

• Structured audit logs on Business and Enterprise track admin actions, data exports, and key rotations.
• Centralized application logs with 90-day hot retention, sensitive fields redacted at the source.
• 24×7 alerting on availability, latency, and security signals (auth anomalies, abnormal exfiltration patterns).

08Incident response

• Documented runbooks for common incident classes (data, availability, credential, AI safety).
• Customer notification within 72 hours of confirmed personal-data breach, per Vietnam Decree 13/2023/ND-CP.
• Post-incident review and public post-mortem at status.orchexa.io for material incidents.

09Vendor management

Sub-processors are reviewed for security posture (SOC 2 / ISO 27001 / equivalent), data handling commitments, and no-training clauses for LLM providers. The current list is available on request and customers receive 30 days’ notice before a new sub-processor processes Customer Data.

10Compliance and roadmap

• Aligned today with Vietnam Decree 13/2023/ND-CP and GDPR principles.
• ISO/IEC 27001: gap assessment complete; certification target 2026 H2.
• SOC 2 Type II: observation period scoping in progress; target 2027 H1.
• Data Processing Agreement (DPA) available for all paid tiers on request.

11Customer responsibilities

• Use a strong password and enable available authentication options for your team.
• Keep API keys secret; rotate immediately if exposed.
• Avoid uploading regulated data (cardholder data, government IDs at scale, special-category data) without a separate agreement.
• Configure agent guardrails and tool allow-lists in line with your risk tolerance.