Security you can check, not just claims
This page states what ORVEXIA actually does today, what every product is designed against, and — just as important — what we do not claim yet.
Where we stand today Pre-launch
No ORVEXIA product is in general availability. That means there is no production system holding customer data, no uptime history, and no third-party audit to show. What exists is a set of engineering principles applied from the first line of every product — described below in the present tense only where it is already true of the code.
See the status page for what will be monitored once anything is live, and the Trust Center for documentation as it becomes available.
What every product is built against
These are design commitments, not certifications. They shape decisions before a feature is written.
Encryption by default
Data encrypted in transit and at rest, with the encryption decided at design time rather than added when someone asks for it.
Least privilege
Role-based permissions so a person reaches only what their work requires — and nothing inherits admin because it was convenient.
Strong authentication
Second factor treated as a default rather than an upgrade. ORVEXIA Authenticator exists because we needed it ourselves.
Collect less
The safest record is the one never stored. Retention and residency are product decisions, not settings buried in an admin panel.
Auditability
If it changed data, it should be possible to say who did it and when. Logs are designed in, not bolted on after an incident.
Recoverability
Backups that have been restored at least once are the only backups that count. Recovery targets get published when services go live.
What we do not claim
Plenty of companies imply these. We would rather list them:
GDPR, CCPA, ISO 27001 and HIPAA are the frameworks our controls are designed against. Certification is a separate, audited process we will announce in the newsroom when — and only when — it is complete.
Found something? Tell us
Report a suspected vulnerability to security@orvexiatech.com. Machine-readable contact details are published at /.well-known/security.txt.
Being honest about the response: ORVEXIA is a small team pre-launch. We aim to acknowledge a report within three business days. We do not pay bounties yet and we will say so rather than go quiet. We will not pursue legal action against research done in good faith that stops at proving the issue exists.