Security Overview

Security at Orbidex

How we protect your data and your customers' data. Last updated: July 2026

Orbidex is a multi-tenant IT Help Desk and Asset Management platform. Each customer's data is isolated, access-controlled, and encrypted. We are built on enterprise-grade cloud infrastructure and follow industry best practices for web application security.

🏗️

Infrastructure

  • Hosted on Render (US)
  • PostgreSQL database via Supabase
  • All traffic served over HTTPS/TLS 1.2+
  • Data encrypted at rest (AES-256)
  • Automated daily database backups
  • Point-in-time recovery available
🔐

Authentication & Access

  • Supabase Auth with JWT tokens
  • Short-lived tokens (1-hour expiry)
  • Row-Level Security (RLS) on database
  • Role-based access control (5 roles)
  • Multi-tenant isolation enforced server-side
  • Session invalidation on account suspension
🛡️

Application Security

  • Content Security Policy (CSP) headers
  • XSS prevention (output escaping)
  • CSRF protection via same-origin policy
  • SQL injection prevention (parameterised queries)
  • Request body size limits enforced
  • Secure HTTP headers (via Helmet.js)
🔑

Secrets & Keys

  • API keys hashed (SHA-256) before storage
  • HMAC-signed share links (no guessable URLs)
  • No secrets in client-side code
  • Environment variables via platform secrets manager
  • Webhook payloads HMAC-signed
  • Fail-fast on missing required secrets

Third-Party Sub-processors

Provider Purpose Data Stored Region
Supabase Database & Authentication All application data, user credentials US East (AWS)
Render Application Hosting Application code, logs (30 days) US Oregon (AWS)
Resend Transactional Email Email addresses, notification content US

Data Handling

CategoryPracticeStatus
Data isolation Each company's data is scoped by company_id; cross-tenant access is impossible at the application layer Enforced
Data in transit TLS 1.2+ enforced; all API calls and database connections encrypted Enforced
Data at rest AES-256 encryption via Supabase (managed) Enforced
Attachment retention Configurable per company (default 6 months); automatic cleanup Configurable
Audit logging All admin actions logged with actor, timestamp, before/after values Enabled
Right to deletion Full customer data deletion available on account termination Available

Responsible Disclosure

We take security reports seriously. If you discover a vulnerability, please report it to our security contact below before public disclosure. We aim to acknowledge reports within 48 hours and resolve confirmed issues within 30 days.

Security Contact
security@orbidex.app
Response SLA
48 hours
PGP Key
Not yet published