Security & Trust

Our commitments

Orenna Restoration Intelligence is built for organizations that trust us with sensitive project, site, and regulatory data. This page describes the security and data-handling practices in place today. Three commitments shape everything below:

• We do not train AI models on your data.
• We retain the content of AI requests only as long as needed, within limits

you control.

• Your data is isolated to your organization — and it is yours to export or

delete.

Authentication & access

• Sign-in is handled by our identity provider (WorkOS), supporting single sign-on

and social login. The browser session lives in a sealed, http-only, secure cookie; the API authenticates every request with a short-lived bearer token verified against the provider's published keys.

• Access within an organization is role-based — admin, editor, and

viewer — and every project resource is membership-checked on each request.

• Administrative access to shared platform resources is limited to a small,

explicit operator allowlist, separate from customer roles.

Tenant isolation

Every project and record is scoped to the organization that owns it. A request that references another tenant's data is rejected as if the record did not exist — a 404, never a hint that it exists. As defense-in-depth, a database-layer guard independently verifies that each query is scoped to the caller's organization and to projects they have been granted access to, so an unscoped query cannot silently cross tenants.

Encryption

• In transit: all traffic is served over HTTPS (TLS), with HTTP Strict

Transport Security enabled.

• At rest: application data is hosted on managed infrastructure with

encryption at rest, and uploaded files are stored in encrypted object storage.

• Your provider keys: if you bring your own AI provider key, it is encrypted

at rest with AES-256-GCM under a platform key and never returned to the browser — only a short fingerprint is ever shown.

How we handle AI data

To produce outputs, your inputs are sent to AI model providers (see Sub-processors). We operate under arrangements where your inputs and outputs are not used to train the providers' models.

• We keep a record of AI calls for security, billing, and debugging. The

content of those calls is stripped to one-way hashes after your organization's retention window (30 days by default): the metadata (model, token counts, cost) is preserved, the prompt and response text is not.

• Zero-retention mode stores AI-call content as hash-only from the first

write, so request and response bodies are never persisted by us.

• Bring-your-own keys route calls under your own provider account; our stored

record of those calls is hash-only.

You manage all of this under Settings → Privacy.

Data integrity

Data exports and key artifacts carry an Ed25519-signed, canonicalized manifest, so their contents are tamper-evident and can be independently verified.

Your controls

• Export your data — every user can download a signed archive of their own

data; organization admins can export the entire organization.

• Delete your data — request erasure of your account, or (as an admin) of the

whole organization, processed after a short grace period during which you can cancel.

• Retention & zero-retention — choose how long AI-call content is kept, or

turn retention off entirely.

• Bring your own keys — run AI on your own provider account, and optionally

disable our shared key so calls fail closed without yours.

Operational security

• Rate limiting on the API, with a dedicated bucket for inbound webhooks.
• Strict security headers (a Content-Security-Policy and related protections) on

every response.

• Sensitive fields are redacted from application logs.
• Inbound webhooks are signature-verified before they are processed.

Sub-processors

We rely on a small set of vetted sub-processors to operate the service — see the current list. We do not sell your data.

Reporting a vulnerability

If you believe you have found a security issue, please contact us at security@orenna.io. We investigate every report and will keep you informed. We will notify affected customers of a confirmed breach of their data without undue delay.

Contact

Security & trust questions: security@orenna.io · Orenna Holdings, PBC.