Skip to main content

Security

This page documents the security controls available to tenant admins.

Authentication​

  • Password policy: 12-char minimum, complexity, no breach reuse, 180-day rotation.
  • Session timeout: default 8 hours; configurable 1-24h.
  • MFA: per-user opt-in by default; force per role with RBAC Premium.
  • SSO: SAML 2.0 / OIDC, optionally enforced.
  • Account lockout: 5 fails → 15 min lockout. 10 fails → admin unlock required.

Network controls​

  • IP allow-list (Premium): restrict admin endpoints to specific IPs.
  • TLS 1.2+ enforced on every endpoint.
  • HSTS preload with includeSubDomains.

Data protection​

  • Encryption in transit: TLS 1.2+.
  • Encryption at rest: AES-256.
  • Field-level encryption (Premium): Fernet for sensitive columns; per-tenant KMS-backed key.
  • Key rotation: 90-day automated rotation.

Audit & monitoring​

  • Audit log: immutable, 7-year retention default; see Audit Log.
  • Anomaly detection (Premium): heuristic detector for unusual access patterns.
  • SIEM integration (Enterprise): stream audit events to your SIEM via syslog / Splunk HEC.

Privacy​

  • PDPL (UAE) compliant data handling.
  • Right to access / deletion: data subjects can request via privacy@orkstra.com.
  • Data residency: primary region is UAE (Neon Postgres). Multi-region (Enterprise) available.

Incident response​

  • Reporting: security@orkstra.com — encrypted via PGP if needed (key on website).
  • SLAs: P1 (data breach) → 4-hour response, 24-hour public notification. P2 → 24h response.
  • Status page: status.orkstra.com.

Compliance certifications​

  • SOC 2 Type II — in progress, targeted certification 2026 Q4.
  • ISO 27001 — planned.
  • PDPL (UAE) — compliant.

Pen testing​

ORKSTRA runs annual third-party penetration tests. Enterprise customers can request the latest pen-test summary under NDA.

Troubleshooting​

  • "Strange login alerts in Anomalies." — Review under Admin → Security → Anomalies. Confirm or escalate.
  • "User reported suspected phishing." — Forward to security@orkstra.com. Reset the user's password immediately and rotate any API tokens they created.
  • "Need to revoke an active session." — Admin → Users → [user] → Active sessions → Revoke.

See also: RBAC Premium + AI, Audit Log.