Orbinly is multi-tenant: many agencies and their clients share the same platform, so keeping them apart is the most important job the system has.

Isolation at the database

• Every table is protected by row-level security (RLS). The database itself decides which rows a person may read, based on who they are.
• A team member can only reach their own agency's rows. A client contact can only reach rows for their own company within that agency, and only the parts their role allows.
• This is enforced even if the application code had a bug, because the rule lives in the database, not the interface.

Other protections

• Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Files are never public. See File access and signed URLs.
• Our hosting and database providers are listed on the Sub-processors page.
• Every response carries security headers (HSTS, frame protection, and a Content Security Policy), and sessions use strictly necessary cookies only.

The overview is on our Security page.