Security
Your data and your clients' data are our top priority. Here's how we protect it.
Row-level security
Every database query is filtered at the PostgreSQL level using row-level security (RLS) policies. Even if application code has a bug, one tenant's data can never leak to another.
Encryption at rest and in transit
All data is encrypted at rest using AES-256 and in transit using TLS 1.2+. Database connections use SSL. File storage uses server-side encryption.
Signed, expiring file URLs
Files are never served from public URLs. Every download generates a signed URL that expires after one hour. Guessing another client's file URL is not possible.
No tracking cookies
We use strictly necessary cookies to maintain your session. We do not use tracking, advertising, or analytics cookies. Your browsing is not profiled.
File upload validation
Uploaded files are validated against an allowlist of safe MIME types. Executable files (.exe, .bat, .cmd, etc.) are blocked at both the client and server level. File size is capped at 50 MB.
Security headers
All responses include Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options (DENY), Referrer-Policy, and Permissions-Policy headers.
Infrastructure
- Database: Supabase (PostgreSQL) hosted on AWS, US East (us-east-1).
- File storage: Supabase Storage (AWS S3) with server-side encryption.
- Hosting: Vercel edge network with automatic SSL certificate provisioning.
- Payments: Stripe (PCI DSS Level 1 certified). We never store card numbers.
- Email: Resend with SPF/DKIM/DMARC authentication.
Reporting a vulnerability
If you discover a security vulnerability, please email security@orbinly.com. We take all reports seriously and will respond within 24 hours. Please do not disclose vulnerabilities publicly until we've had a chance to address them.