Security built into every request

Every request passes three checks in order: is this person signed in, do they belong to this organisation, and does their role allow this action.

• Nine default roles, from Owner and Admin to Field Technician and Viewer
• Custom permission sets per resource and action
• Record scope per resource: own records, team records or all records
• The AI assistant and automations re-check the same permissions for every lookup

Short-lived signed access tokens with rotating refresh tokens. Reusing an old refresh token signs the user out everywhere.

• Passwords stored as bcrypt hashes, never in plain text
• A list of signed-in devices with remote sign-out
• Changing a password revokes every other session
• Optional biometric lock on the mobile app

Each organisation’s records carry its organisation id, and every query is scoped to the caller’s organisation by the API.

• Platform administrators use a separate identity that cannot call tenant routes
• Cross-organisation listings exist only on the platform console

Every change made through the API is recorded with who made it, when, and to which record. Actions taken by the WhatsApp AI agent are recorded too.

• Request bodies are not written to the audit log
• History appears on each record’s activity timeline

Secrets you give Orbit, such as your SMTP password, AI provider keys and WhatsApp Cloud API credentials, are encrypted with AES-256-GCM before they are stored.

• Traffic is served over HTTPS
• The mobile app keeps its offline copy in an encrypted database

Uploaded files are kept in private storage. Previews and downloads use short-lived signed links that are checked against the viewer’s permissions.

With Local Mode you can run Orbit on your own server, with scheduled daily, weekly and monthly backups and an automatic backup before every update.

Account and workspace deletion requests are reviewed and processed by an administrator. A deleted account is anonymised so business records stay consistent.