How we protect your data.
orta holds detailed data about your infrastructure. This is how we keep it isolated, encrypted, on the record and out of reach without your approval.
Your data is isolated in the database
Every tenant is separated with Postgres row-level security. The application itself runs as a role that cannot bypass it.
Secrets are encrypted
Cloud credentials, ticketing tokens, chat integrations and two-factor secrets are encrypted with AES-256-GCM.
Every action is on the record
Every authenticated API call is logged with who, what, the old and new value, and where it came from, and kept for a year.
Support only with your approval
Our team can see your workspace only when your owner approves a request: read-only, for 5 to 240 minutes, with every request tagged in your audit log.
Two-factor sign-in
An organisation-wide policy: off, optional or required for everyone, with replay protection.
Least privilege by default
Built-in roles from owner to read-only auditor, each one adjustable for your organisation, with every change audited.
Read-only where it should be
Cluster and cloud access are read-only. orta never changes your infrastructure unless you switch a policy to enforce.
Backups you can restore
Encrypted nightly backups, with a restore tested every week.
Kept only as long as needed
Raw events are kept for 30 days, vCISO conversations for 30 days and the audit log for a year by default.
How AI features use your data
Alert triage, interviews and the vCISO run on hosted models from third-party providers, which receive the data each feature works on, such as an alert's evidence or an interview answer. None of these features can change your infrastructure.
Need our security questionnaire answered or a deeper review? Talk to us.