Security
How we protect your data: 2FA, audit logs, GDPR export, encryption and more.
Security is foundational at Orbitus, not an afterthought.
Every account supports two-factor authentication (TOTP + backup codes), OAuth (Google, GitHub, Apple) and magic-link sign-in.
Workspace owners get audit logs, login history, GDPR data export and progressive rate limiting out of the box.
Reach us at security@orbitus.dev for vulnerability disclosures.
Built-in security features
TOTP with backup codes, OAuth (Google, GitHub, Apple) and magic-link sign-in for every account.
Tamper-evident audit trail for every workspace, scoped per module.
Workspace owners can export every record about every user at any time.
Four-tier rate limiting on sign-in, sign-up, password reset and API endpoints.
Visible login history per user with IP, user agent and country signals.
TLS 1.2+ in transit; AES-256 at rest at the database and backup level.
Compliance roadmap
Targeting initial audit in late 2026.
Roadmap follows SOC 2 — early 2027.
DPA available; sub-processors disclosed; user data export built in.
Email security@orbitus.dev or follow our security.txt. We respond within one business day.
