Everything a reviewer needs, in one place
Last updated: August 22, 2026
ORVEXIA has not launched. This page lists the documents that exist today, who processes data, and what we do not have yet. The security posture itself — including the certifications we do not hold — lives on its own page.
Where we stand today Pre-launch
No ORVEXIA product is in general availability. There is no production system holding customer data, no uptime history and no third-party audit to show. Everything below is what actually exists today — nothing on this page describes a service that is running.
What you can read today
These are published and linked, not available on request. Nine documents, all of them live right now.
Security posture →
What every product is designed against, and the certifications we do not hold.
Privacy Policy →
What personal data we collect, why, and how long we keep it.
Terms of Service →
The terms that will govern use of ORVEXIA products.
Cookie Policy →
What this site sets, and how to change it.
Responsible AI →
Where AI assists, where a person stays accountable, and what we will not do.
Accessibility →
Our accessibility commitments and known gaps.
Privacy request portal →
Ask for a copy of your data, a correction or a deletion.
security.txt →
Machine-readable contact details for reporting a vulnerability.
Status →
What will be monitored once anything is live.
What every product is built against
These are design commitments, not certifications and not running services. They are stated in full, with what we do not claim, on the Security page.
Encryption by default
Encrypted in transit and at rest, decided at design time rather than added when someone asks.
Least privilege
Role-based permissions, and nothing inherits admin because it was convenient.
Strong authentication
A second factor as a default rather than an upgrade.
Collect less
The safest record is the one never stored.
Auditability
If it changed data, it should be possible to say who did it and when.
Recoverability
Backups that have been restored at least once are the only backups that count.
Frameworks we design against
GDPR, CCPA, ISO 27001 and HIPAA are the frameworks our controls are designed against. We hold none of them as a certification, and we would rather say so here than let a logo imply otherwise.
Not certified: SOC 2 Type II, ISO 27001, PCI DSS. Not held: HIPAA attestation. Not authorized: FedRAMP. No published penetration test, no bug bounty programme, no uptime history.
Certification is a separate, audited process. When one completes we will announce it in the newsroom — and only then. The full list is on the Security page.
Who actually touches data today
ORVEXIA has no customers and no product database holding personal data. The only personal information we receive is what you type into a form on this site.
| Subprocessor | Purpose | What it receives |
|---|---|---|
| Resend | Delivers the email generated by the forms on this site: contact, sales, waitlist and privacy requests | The name, email address and message text you submit |
| Cloudflare | Hosts and serves this site, provides DNS for orvexiatech.com, and runs the form endpoints at the edge | Standard request metadata — IP address, browser and the page requested — and the contents of a form while it is being delivered |
That is the whole list as of 22 August 2026: two providers, neither of which holds a product database. It will be republished here before the first customer exists, and material changes announced in advance.
Answers to common questions
Written for the person doing the review, not for the brochure.
How is my data encrypted?
This site is served over HTTPS and its forms post to endpoints on the same domain. Inside the products, encryption in transit and at rest is a design commitment — none of them is in production yet, so there is no live system to describe.
Where is my data stored?
Today the only personal data ORVEXIA receives is what you submit through a form here, which reaches us as email through Resend. There is no product database holding customer data. Residency options will be described when there is a service to apply them to.
Do you use my data to train AI models?
No. Nothing you send us is used to train models, and we will not introduce that quietly — see Responsible AI.
How do you handle backups and recovery?
There is no production service to back up yet. Recoverability is one of our design commitments, and recovery targets get published when services go live.
How can I report a vulnerability?
Email security@orvexiatech.com, or use the details at /.well-known/security.txt. We aim to acknowledge within three business days. We do not pay bounties yet and we will say so rather than go quiet.
Can I get a DPA or an audit report?
Neither exists yet: there is no published DPA template and no audit reports. If you need something we do not have, the answer will be that — not a document dressed up to look like one.
Doing a security review of us?
Ask for what you need at security@orvexiatech.com. If we do not have it yet, that will be the answer.