Trust & Security
Trust Center
Security, compliance, and transparency built into every layer of IOA Cloud
Security Posture
Infrastructure Security
- Hosted on AWS, which holds its own SOC 2 Type II report and ISO 27001 certification
- HTTPS with TLS 1.2 or 1.3 on public endpoints
- Database and backups encrypted at rest (AES-256, AWS-managed keys)
- Public traffic to orchintel.com and the console is routed through Cloudflare
Data Protection
- Session records encrypted at rest in AWS us-east-1
- QiXMind session receipts are signed (Ed25519) and can be checked against a published key registry
Access Controls
- Organisation roles: admin, member, viewer and billing manager
- Sign-in with email and password, Google or GitHub, managed by Clerk
- Administrative actions in the console are logged
Compliance & Certifications
Independent Certifications
None held
OrchIntel does not currently hold SOC 2, ISO 27001 or ISO/IEC 42001 certification.
GDPR-Aligned Controls
Active
GDPR-aligned controls. Data is stored in the US (AWS us-east-1); EU data residency is not available yet.
View GDPR details →Data Residency & Sovereignty
IOA Cloud runs in one AWS region today: US East (N. Virginia), us-east-1. Other storage regions are not available yet.
US
Application and database
AWS us-east-1 (N. Virginia)
- Application services run on AWS ECS in us-east-1
- Session records, receipts and audit logs are stored in an encrypted database in us-east-1
US
Backups
AWS us-east-1 (N. Virginia)
- Automated database backups, kept for 7 days
- Backups stay in us-east-1 and are not copied to other regions
AI
Model processing
Set by each model provider
- Text sent for generation is processed by the model providers listed below
- Where they process it is governed by their terms, which we are confirming
Need another region? EU, Asia-Pacific and other storage regions are not offered today.
Talk to us about your requirements →
Sub-Processors & Third-Party Services
IOA Cloud uses the following sub-processors.
| Vendor | Service | Data Type | Location |
|---|---|---|---|
| Amazon Web Services | Cloud infrastructure, storage, backups, email | Session records, receipts, evidence bundles, audit logs | US (us-east-1) |
| OpenAI | Model processing | Text sent for generation | Per provider terms (being confirmed) |
| Model processing | Text sent for generation | Per provider terms (being confirmed) | |
| Clerk | Sign-in and account management | Name, email address, sign-in records | Per provider terms (being confirmed) |
| Cloudflare | DNS, CDN and traffic proxy for orchintel.com and the console | Web traffic, including IP addresses | Global |
| Stripe | Payment processing | Billing information | US |
Model processing: Hosted products such as QiXHealth and QiXMind send the text needed for generation to the
model providers above, using OrchIntel-held API keys. If you run IOA Core with your own provider keys, your provider
processes prompts under your own agreement with them.
Security Practices
Vulnerability Management
- Responsible disclosure policy: report issues to security@orchintel.com
- Automated dependency alerts on the open-source IOA Core repository
Transparency
Questions about security or compliance?
Our security team is here to help with audits, questionnaires, and custom compliance requirements.