Security and AI controls
Each organization's data is isolated in code and in the database, so one organization cannot read another's. AI can read and draft but cannot change payments, prices or invoice amounts, and risky actions need human approval. Passwords are stored as hashes, sign-in attempts are rate limited, and audit records cannot be edited or deleted.
Status: In development
In place today
- Organization isolation enforced in application code and by composite foreign keys in the database.
- Passwords stored as hashes; sign-in attempts rate limited.
- Deactivating a user ends all their sessions immediately.
- An organization can never be left without an active Owner, enforced in the database.
- The audit table rejects updates, deletes and truncation at the database level.
Designed and in development
- Human approval for every risky AI-proposed action.
- Daily AI spending limits per feature, with every model call recorded.
- Cloudflare Turnstile and daily limits on new sign-ups.
What it is not
Orbyte has not had an independent security audit. If you find a vulnerability, please write to [email protected].
Last updated: