Built so that a mistake cannot leak your data

Every organisation gets its own MongoDB database, not a row in a shared table filtered by a tenant column. There is no cross-tenant query path to get wrong, because a query cannot address two databases at once.

The tenant is resolved by the API gateway from your authenticated session and travels inside the request to every service. Nothing a browser sends — no header, no payload field — can name a different organisation.

Every request passes through a single authenticated GraphQL gateway that validates your identity and your permissions before anything else runs. The services behind it are not reachable from the internet; they speak only to the gateway over a private message broker.

Public surfaces — a careers page, a shared recording — are served by the same gateway on explicit public routes, rate-limited, with the rest of the platform behind the login.

Every connection is TLS: browser to Orbiz, Orbiz to its providers. Passwords are stored as salted hashes. The database and object storage providers encrypt on disk.

Vault goes further. Credentials are encrypted in your browser with a key derived from your passphrase before they are sent, so the server holds ciphertext it cannot decrypt. A forgotten passphrase is recovered through an escrow flow your admins control — never by us reading the data.

Authorisation is permission-based. Each tool exposes granular read and write permissions and you compose them into roles per member. Only an Admin can make or unmake an Admin. Salaries are visible only to the Admin and Finance Manager roles you assign; an employee sees only their own pay, and reveals it only after re-entering their password.

When a member leaves, one switch removes their access to every tool at once, and an Admin can erase them across the whole platform — irreversibly, with a preview of what will be removed first.

A member can connect Claude, ChatGPT or Claude Code to Orbiz. The assistant acts as that member in that organisation: the approval page lists access tool by tool, with reading separate from changing, and offers only what the member’s role could already do. The Vault has no assistant actions at all, and no action deletes anything.

Each action is listed in an activity log with the assistant, the outcome and the time; members see their own and admins see the organisation’s. A member can disconnect an assistant at any time, an admin can disconnect anyone’s, and one switch turns AI assistants off for the whole organisation. The AI assistants page describes it in full.

Every read, share and change to a Vault item is recorded with the actor and the time. Role and permission changes, attendance corrections, leave decisions, payroll approvals and the erasure of a member are recorded the same way and are visible to your admins inside each tool.

Payroll runs freeze the policy and pay profiles they were computed from, and every line on a salary sheet carries an explanation of how it was calculated.

The application runs on Amazon Web Services in the Asia Pacific (Mumbai) region. Files, recordings, documents and payslips are stored in Amazon S3 under a prefix per organisation and served through signed, expiring URLs. Databases run on MongoDB Atlas.

The full list of providers, what each handles and where, is on the sub-processors page. Dedicated or region-specific hosting is available on the Enterprise plan.

Because each organisation has its own database and storage prefix, an export is the whole thing, not a CSV of the parts we chose. Ask, and you get it. Deletion follows on request, confirmed in writing once you have your copy.

Inside the product, reports and payroll exports are yours to download at any time, and a private document is never sent to a third-party viewer — it opens in your own browser.

Email orbiz-support@innovation-insight.com with “security” in the subject. A person reads it the same business day. We acknowledge every report, keep you informed while we investigate and fix, and credit you if you want to be credited. We do not pursue researchers who report in good faith.