Security
Clients see a published page. Never the board.
The whole product is built around one rule: what reaches a client is an allowlist you approved, not a filtered view of your internal data.
What a client can read
- Client pages read a published snapshot. They cannot query the raw board, approval notes, or internal payloads.
- Only mapped status, date, action, and file columns can appear. Columns named like notes, costs, prices, margins, budgets, fees, or salaries are refused.
- A client sees only projects they were invited to. Revoking access ends their session and every file link at once.
- File links are signed, last five minutes, and re-check access on every download.
Tenancy
- Every row carries its workspace id, and every staff query is scoped to the signed-in workspace.
- A guessed project id from another workspace returns the same empty result as one that does not exist.
- Tenant isolation is covered by automated tests that try to read across workspaces.
Accounts and secrets
- Passwords are hashed with scrypt. Sessions are signed, HTTP-only, secure cookies that expire after 12 hours.
- Sign-in, sign-up, password reset, and contact forms are rate-limited.
- Connection tokens (project tools and mailboxes) are encrypted with AES-256-GCM. Logs redact tokens, secrets, and passwords.
- Invites and reset links are random, stored only as hashes, single-use, and short-lived.
Infrastructure
- Hosted on Vercel in the EU (Dublin) with a Supabase Postgres database in the EU (Ireland).
- HTTPS everywhere, with HSTS, a content security policy, and frame protection.
- Incoming webhooks (Monday.com, Paddle) are signature-checked and rejected otherwise.
- Owners can export the whole workspace and delete it. Deletion removes tenant data.
What we don’t have yet
Said plainly, so you can decide with the full picture.
- No two-factor sign-in or single sign-on for staff accounts yet. Use a long, unique password.
- No third-party certification such as SOC 2 or ISO 27001.
- Database row-level security policies are written but not switched on. Workspace separation is enforced in every application query and checked by automated tests.
- A customer link works for anyone who has it. Approvals can be confirmed by an email code, and you can switch a link off at any time.
The operator is Infinity Consciousness Europe SIA in Latvia. The data processing agreement, privacy notice, and list of subprocessors are public. Found a vulnerability? Write to hello@orbitcue.app with “Security” in the subject.
Fewer “any update?” calls next week.Try it free for 14 days.
Send your first customer a link in about five minutes. No card needed to try it.
Then €19 a month, or €149 once for life
- 14 days free, no card
- 30-day money-back guarantee
- Hosted in the EU