Security / trust page — found from the homepage — Orb

Cited by

Facts read from this source

• Provider Report an error

  “Orb uses Amazon Web Services as its cloud infrastructure provider, and uses a virtual private cloud (VPC) for resource isolation.”

• On site storage Report an error

  “Orb does not store customer data on-site or on Orb machines”

• Penetration testing Report an error

  “Orb uses an independent third-party security research firm to perform comprehensive penetration testing which includes reviewing development artifacts.”

• SOC 2 Report an error

  “As part of Orb’s SOC-2 Type II compliance program, Orb submits to a third party SOC-2 audit annually.”

• Encryption at rest Report an error

  “All production customer data within Orb’s infrastructure is encrypted at rest including S3 buckets for long-term storage, volumes attached to instances, and in production datastores.”

• Encryption in transit Report an error

  “Orb’s APIs and web application are offered over HTTPS using TLS, ensuring that data is encrypted in transit”

• List Report an error

  “Orb maintains a list of subprocessors, and is responsible for ensuring that these subprocessors also follow security best practices to ensure that customer data is protected.”

• DPA Report an error

  “A full data processing addendum for Orb’s services is available on request by emailing security@withorb.com.”

• Retention Report an error

  “Orb backs up customer data using regular database snapshots with a 7-day retention period or long-term archival such as S3. These snapshots allow for point-time-recovery of the application.”

• Deletion Report an error

  “On request, Orb is also able to delete customer data and provide evidence of deletion.”

• Access control Report an error

  “Orb requires that employees use SSO or MFA to login to all company resources when available”

• Vulnerability disclosure Report an error

  “We invite security researchers to report any potential vulnerabilities they may discover within the following scope to security@withorb.com.”

• Network security Report an error

  “Orb uses network protection solutions at multiple layers of its infrastructure stack: Cloudflare proxy: On select endpoints, Orb uses Cloudflare proxy to prevent denial of service attacks.”

• Source code hosting Report an error

  “The source code is hosted at GitHub, a SOC-2 compliant organization, under a private repository protected by multi factor authentication.”

• Employee training Report an error

  “All employees at Orb undergo IT security training and annually review security policies as well as any updates in the interim.”

• Background checks Report an error

  “During the onboarding process, Orb conducts background checks for new hires, including identity verification and criminal records check.”

• Incident response Report an error

  “Orb maintains a detailed incident response team and plan, as well as regular tabletop exercises that simulate risk scenarios for the business.”

• Endpoint security Report an error

  “Orb uses a centralized device management solution (MDM) to protect company hardware from breach and enforce best-practices such as password policies, encryption at rest, and firewall.”

• Environment isolation Report an error

  “Orb employs separate isolated environments for local testing and production or beta clusters, and enforces that there is no production customer data in local development environments.”

Scores citing this record

• The Billing Engineer European sovereignty
• The Finance Lead European sovereignty
• The SaaS Founder European sovereignty
• The Service-Business Owner European sovereignty
• The Skeptic European sovereignty
• The Tax Adviser European sovereignty