Your code stays on your machines.
The agent works inside your network. Orquesta sends it the prompt and keeps the log — never a copy of your repository.
Others can prompt it. You decide what it can touch.
Runs on your machine
The agent is a process on your server. It dials out to Orquesta; it opens no inbound port.
Sandboxed per project
Standard or strict isolation. Hide git, SSH, cloud and npm credentials, or cut the network entirely.
Secrets redacted at the source
Tokens and keys a tool prints are replaced with [REDACTED] before the log leaves the machine.
Roles for team and clients
Every prompt has an author, a role and a log. Sensitive work waits for a human sign-off.
Where we stand.
SOC 2 Type II
CertifiedAnnual third-party audit covering security, availability, and confidentiality.
GDPR
CompliantEU data protection. Data Processing Agreement available on request.
CCPA / CPRA
CompliantCalifornia privacy rights, with deletion and opt-out in place.
HIPAA
ReadyBusiness Associate Agreement available. PHI handling and encryption in place.
OWASP Top 10
CompliantTested against every OWASP Top 10 vulnerability category.
Encryption
AES-256 / TLS 1.3Encrypted at rest (AES-256-GCM) and in transit (TLS 1.3).
How we run the platform.
Penetration testing
Annual tests by independent firms. Summary available under NDA.
Vulnerability scanning
CVE scanning on every build. SAST in CI.
Secret detection
Pre-commit and CI checks. No secret is stored in plain text.
People
Security training and least-privilege access for everyone on the team.
Incident response
One-hour acknowledgment for P1 incidents. Postmortem within 72 hours.
Infrastructure
Daily snapshots, network isolation, WAF and DDoS protection.
Encrypted, hashed, yours.
Encryption
- AES-256-GCM at rest for stored data
- TLS 1.3 for everything in transit
- Provider credentials encrypted with a dedicated master key
- Agent, CLI and API tokens stored only as SHA-256 hashes
- Row-level security on every table the dashboard reads
Residency and retention
- Your repository stays on your machine; we store prompts and logs
- Data residency options: US, EU, LATAM, APAC
- Configurable retention policies
- Automated daily backups
- Secure deletion when an account is closed
Who else touches data.
Each one is reviewed for security and covered by a data processing agreement.
| Service | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting | US East (Virginia) |
| Google Cloud Platform | Database (self-hosted Postgres) and realtime relay | US Central (Iowa) |
| Stripe | Payment processing | US |
| Brevo | Transactional and CRM email | EU |
| Anthropic | Model provider for Batuta | US |
| OpenAI | Model provider for Batuta | US |
| Google (Gemini API) | Model provider for Batuta | US |
| OpenRouter | Model routing for Batuta | US |
| DigitalOcean | Customer VM provisioning (Cloud VMs) | Various |
Model providers only see prompts routed through Batuta. Prompts your agent runs with your own CLI go to the provider you configured on that machine.
Everything your review asks for.
Found something? Tell us.
We acknowledge reports within 24 hours and share a fix timeline within 72.
How to report
- Email security@getorquesta.com with a description of the issue
- Include steps to reproduce, affected endpoints and impact
- Allow up to 90 days for remediation before public disclosure
- We credit researchers who report valid issues, unless you prefer anonymity
