ORPIO is built with security as a first principle. We apply industry best practices across every layer of our infrastructure to protect your project data, team information, and operational readiness plans.
We are pursuing SOC 2 Type II certification and are compliant with GDPR and CCPA. Our platform enforces row-level security for strict multi-tenant data isolation, AES-256 encryption at rest, and TLS 1.2+ for data in transit.
SOC 2 Type II audit is currently underway. Completion expected Q4 2026. Our full compliance report will be available upon request.
All data is encrypted at rest using AES-256 and in transit via TLS 1.2+. Encryption keys are managed with industry-standard key management practices.
ORPIO is hosted on enterprise-grade cloud infrastructure with redundant availability zones, automated backups, and 99.9% uptime SLA.
Role-based access control (RBAC) ensures users only see data they are authorized to access. All admin actions are logged in a tamper-evident audit trail.
Automated daily backups with point-in-time recovery. Backup data is encrypted and stored in geographically separate locations.
Regular security assessments and dependency audits. Critical vulnerabilities are patched within 24 hours; high-severity within 72 hours.
A documented incident response plan is in place. Affected customers are notified within 72 hours of a confirmed breach in accordance with applicable regulations.
Faster task loading on large projects and clearer gate readiness indicators across the project dashboard.
Gate and task attachments are now stored in tenant-scoped encrypted storage with time-limited download links.
New operating budget workspace with payroll modelling and P&L summaries for each project.
Customer data is stored in the United States by default. Enterprise customers may request a specific data residency region — contact us to discuss your requirements.
Data is retained for the duration of the subscription. Upon account cancellation, customer data is retained for 30 days to allow for export, after which it is permanently deleted from all systems within 90 days.
Backups are retained for 30 days and are subject to the same encryption and access controls as production data.