Security

We take security seriously. Here's how we protect your data and infrastructure.

Encryption at Rest

All data stored in PostgreSQL is encrypted at rest using AES-256. Database backups are also encrypted. Encryption keys are managed by our cloud infrastructure providers (Neon Database, Render) and rotated regularly.

Encryption in Transit

All API and web traffic is encrypted with TLS 1.2+ (HTTPS). We enforce HSTS headers and maintain an A+ TLS rating. Internal service-to-service communication within the deployment is also encrypted.

Authentication

  • Password Hashing: All passwords are hashed with BCrypt at cost factor 12, with automatic rehashing when the cost increases
  • JWT Tokens: Short-lived access tokens (24h default) signed with a configurable secret. Refresh tokens implement rotation and automatic revocation
  • Account Lockout: Accounts are locked for 30 minutes after 10 consecutive failed login attempts
  • Multi-Factor: TOTP-based MFA support for all accounts
  • SSO: OpenID Connect integration with Microsoft Entra ID, Google Workspace, and Okta

Authorization & RBAC

Orbio implements role-based access control with four tiers: Requester, Agent, Client Admin, and MSP User. Every API request is authenticated and authorized at the controller level. Data is isolated by tenant ID to prevent cross-tenant access.

Infrastructure Security

  • Deployed in isolated Docker containers on Render's Oregon, USA region
  • Database hosted on Neon with network-level isolation and IP restrictions
  • Automated security scanning of dependencies via Dependabot
  • Rate limiting (100 req/min/user when Redis enabled)
  • CORS enforcement with explicit origin allow lists
  • SQL injection protection via parameterized queries (EF Core)
  • File upload validation: allowed types, extensions, and 10MB size limit

Audit Logging

Every security-relevant action is logged to an immutable audit trail: logins, logouts, password changes, role assignments, ticket state changes, and data exports. Audit logs are retained for a minimum of 12 months and are accessible to tenant admins and MSP super admins.

Compliance & POPIA

Orbio is designed for full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's primary data protection law. Our compliance features include:

  • POPIA Registered: Our platform supports organization-level POPIA registration status tracking
  • Information Officer: Designate your Information Officer and Deputy Information Officer with contact details displayed on the PAIA Manual
  • Lawful Basis Tracking: Every consent record captures the lawful basis for processing (consent, contractual necessity, legal obligation, legitimate interest)
  • Data Subject Rights: Built-in DSAR (Data Subject Access Request) workflows for access, correction, deletion, portability, and objection
  • Marketing Consent Center: Granular opt-in/opt-out management with full audit trail and one-click unsubscribe
  • Breach Notification: Automated breach logging, severity classification, regulatory notification tracking, and remediation workflows
  • Data Processing Register: Maintain a register of all processing activities including data categories, subjects, retention periods, and cross-border transfer safeguards
  • Vendor / Sub-Processor Register: Track all third-party vendors with contract dates, data categories shared, and safeguards
  • Staff Training Records: Track POPIA and data protection training for all staff members
  • Data Retention: Configurable retention periods (default 7 years per POPIA prescription period) with automated purge workflows
  • Cross-Border Transfers: Document transfer countries and safeguards for any data transferred outside South Africa
  • Data Processing Agreements (DPAs) available on request
  • Audit Trail: Every consent change, DSAR action, and breach update is logged to an immutable audit trail
  • Privacy-by-design architecture with tenant-level data isolation

Vulnerability Disclosure

If you discover a security vulnerability in Orbio, please report it privately to security@orbio.africa. We commit to acknowledging your report within 24 hours and providing a fix timeline within 72 hours. We participate in coordinated disclosure and welcome responsible security research.