Security
Last updated 24 July 2026
Renovation involves large payments, sensitive floor plans and personal photos of your home. Here's how OrkaiFlow keeps all of it safe.
Encryption
TLS in transit, AES-256 at rest for all photos, documents and database fields.
Role-based access
Every route and every field enforces the caller's role — homeowners never see contractor pricing, contractors never see homeowner invoices.
Workspace isolation
Every query is scoped to your workspace_id. Cross-tenant data leaks are impossible by construction.
Hardened hosting
Runs on Emergent's managed Kubernetes with automated patching, WAF, and DDoS protection.
Least-privilege auth
JWT session tokens, bcrypt-hashed passwords, mandatory password change on first login, and admin-approved staff invites.
Audit trail
Every VO decision, defect status change and payment update writes an immutable timeline entry.
Responsible disclosure
Found a vulnerability? Please email security@orkaiflow.com with steps to reproduce. We'll acknowledge within 48 hours and won't pursue legal action against good-faith researchers.
Compliance roadmap
SOC 2 Type II audit target: Q4 2026. GDPR-aligned DPA available on request for EU customers. Data residency options for enterprise plans coming in 2027.
This is a starter template — replace with your finalised legal text before public launch.