Trust
Trust and security
Your clients trust you with their records, and you trust us with yours. This page says what we do today, in plain words, and what we have not finished.
SOC 2 status
SOC 2: readiness in progress; report available when issued. We are not SOC 2 certified or attested today. A SOC 2 report can only be issued by an independent auditor after an examination.
Customer separation
- Every record belongs to one workspace. Each request carries your workspace identity and every query is limited to it in our application code.
- The database also has row-level security policies on tenant tables as a second layer. We are rolling these out in stages, and we do not rely on them alone.
- We test for cross-workspace access, including guessed identifiers, and fix what we find.
Encryption
- Data between you and our servers is encrypted with HTTPS (TLS), with HSTS enabled.
- Sensitive fields such as client PAN numbers, email and payment-gateway credentials, connection tokens and two-factor secrets are encrypted before they are stored. Our backups are encrypted too.
- Other stored data, including uploaded files, is protected by access controls and is not individually encrypted by the application.
Access control
- Role-based access with admin, manager, operator and viewer roles, plus custom roles you define. Permissions are checked on the server, not just hidden in the screen.
- Two-factor authentication is available for staff and for client-portal users, and an administrator can require it for the whole workspace.
- Sign-in attempts are rate limited, and accounts lock temporarily after repeated failures.
Audit records
- Changes to business records are logged with who, what, when and from where. Actions taken during support impersonation, and actions by automated assistants, are marked as such.
- Each time a full PAN is shown to a user, the disclosure is recorded.
Backups and availability
- The database, uploaded files and configuration are backed up every night, encrypted, with checksums.
- Releases are built and checked before they go live, and an automatic rollback restores the previous version if a new one does not start healthy.
AI features
- AI requests go through our AI service, not directly from your browser to a model provider.
- AI output is a draft: nothing is sent to a client, filed or paid without a person approving it.
- We do not use your business data to train AI models without your explicit consent.
India and data protection
- Oris Work is built for firms in India and for the Digital Personal Data Protection Act, 2023: consent records, data export and erasure requests, and a named grievance contact.
- We run in a single hosting environment and do not offer a choice of region. Ask us for the current server location in writing before you sign up.
- Details of what we collect and who processes it are in our Privacy Policy.
Questions or a security report
Email privacy@oriswork.com or use the contact page. Read our Privacy Policy and Terms of Service.