RM Orbit security and vulnerability reporting

Effective 21 August 2026.

What we do. TLS for all traffic, Cloudflare in front of every service, origin servers not exposed to the internet, hashed passwords, multi-factor authentication available to everyone and required for administrators, tenant isolation enforced at the database layer, restricted and logged production access, encrypted backups with tested restores, dependency scanning, and an incident process with the reporting clocks Indian, UK, and US law set.

What we do not claim. We do not describe Orbit apps as end-to-end encrypted. Mail, files, and meetings are encrypted in transit and at rest on our servers; our systems can process them to provide the service (search, triage, captions) as described in the AI page. Locked notes in Drive are the exception: they are encrypted in your browser and we hold only ciphertext.

Reporting a vulnerability. Email [email protected] with steps to reproduce. We acknowledge within 3 business days, keep you informed, and do not pursue good-faith researchers who avoid privacy violations, data destruction, and service disruption. A machine-readable contact is at /.well-known/security.txt on each Orbit host as it is rolled out, and on this site.

Incident notification. If a breach affects your data we tell you without undue delay, with what happened, what data, what we did, and what you should do.