Security & Trust Disclosure
Overview of our application protection strategies, encryption, and database containment.
1. Data Encryption
All connection requests to OrionHQ are encrypted in transit using Transport Layer Security (TLS 1.3) protocols. All stored files are encrypted at rest inside Google Cloud Storage and Firebase Firestore storage buckets.
2. Firebase Database Security Rules
We enforce complete isolation inside our Firestore rules. Client-side browser code is denied direct write access to critical logging, exports, deletion requests, and consent records. All operations are piped through rate-limited backend API endpoints to prevent script injections.
3. Role-Based Access Control (RBAC)
Platform roles (Owner, Admin, Manager, Editor, Reviewer, Viewer) restrict workspace access scopes. Members can only interact with modules authorized by their assigned roles, validated on every server-side transaction.
4. Compliance Audit Logs
Compliance changes (such as framework activations, policy modifications, and DSAR exports) generate immutable audit logs. These events cannot be overwritten or deleted, ensuring a secure compliance trail for data privacy officers.
5. Incident Response & Vulnerability Disclosures
We conduct regular package vulnerability audits. Security vulnerability reports can be securely submitted tosupport@orionhq.space for swift mitigation.