Trust Center
Security your security team can check
How ORBII Teams protects the people on your plan, where their data lives, and what we have not done yet. Updated 25 October 2026.
At a glance
- 2-step sign-inEvery console user needs an authenticator-app code. The database refuses console requests without it.
- Rules in the databaseWho sees what is enforced by Postgres row-level security and checked functions, not by the screen.
- Every change recordedInvites, removals, roles, settings and API calls go to an audit log the console cannot edit.
- No health data to employersMedical details reach only the people coming to help. Never HR, the desk, reports or the API.
Security controls
What protects the data, in plain words.
- Encryption
- TLS for all traffic (HSTS with preload). Data at rest is encrypted by the hosting provider (AES-256). API keys are stored only as SHA-256 hashes.
- Access control
- Row-level security on every Teams table. App roles cannot write any of them directly; every change goes through a function that checks the caller’s role: owner, admin, Safety Desk or member.
- Location policy
- Field companies: live location during a trip the person started. Office companies: only once someone is overdue and not answering. Universities: only campus security, only during a live SOS. No organisation can see location at any other time, and customers cannot change their own policy.
- Console sessions
- 2-step sign-in required. Signed out after 30 minutes without activity (except browsers set up as Safety Desk alert stations). Signing out ends that browser’s session only.
- Web security
- Strict Content Security Policy on every signed-in page, framing blocked, no caching of console pages, and the console is kept out of search engines.
- API
- Keys are scoped (read people, or invite and remove people), shown once, rate limited to 120 requests a minute, revocable at once, and every change they make is audited. No key can read location, trips, incidents or health.
- Abuse limits
- Invites cannot exceed the seats bought and can be resent at most once a day. Internal and scheduled functions refuse outside callers.
Where data lives
The database runs on Amazon Web Services in Tokyo, Japan. India’s DPDP Act allows personal data to be processed outside India, except in countries the government restricts, and Japan is not one. Hosting in India is planned.
Speech for Voice SOS never leaves the phone. It is recognised on the device.
| Provider | What for | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, server functions | Tokyo, Japan |
| Vercel | Website and console hosting | Global edge network |
| Expo and Google Firebase Cloud Messaging | Push notifications to phones | United States |
| Brevo | Sign-in and invite emails | European Union |
| Razorpay | Payments for individual plans | India |
| OpenFreeMap and Esri | Map and satellite tiles in the console | Global |
How long we keep things
- Membership and roster
- For the length of your contract. Removing a person ends the organisation’s access to them at once.
- Audit log
- For the length of your contract, exportable at any time from the console.
- App analytics
- 90 days, then deleted.
- Notifications
- Undelivered notifications are dropped after an hour, so nobody gets a stale alert.
- Their own account
- Belongs to the person, not the organisation. They can delete it in the app, and it is deleted everywhere.
If something goes wrong
- Breach notice
- We tell affected organisations within 72 hours of confirming a personal data breach, and notify the Data Protection Board as the DPDP rules require.
- Report a vulnerability
- Email orbiisafety@gmail.com with the subject “Security report”. We reply within two working days and never take action against good-faith research.
- Lost authenticator
- Email us from your work address. We reset 2-step sign-in only after confirming it is you.
Security reviews
Need our DPA, a security questionnaire, or a call with your security team? Write to us. See how ORBII Teams works.