A role sets the boundary.
Roles define what a person can read and do. Questions and actions use the same permission checks as the rest of the service. Asking does not grant more access.
The business knows more. Access stays deliberate.
Your company’s record connects commitments, decisions and actions. That should make the business more accountable without making its information available to everyone.
Knowing more should not mean sharing more.
Access follows a person’s role and the company they belong to. Private information has a separate boundary.
Private stays personal.
Your private conversations and personal notes are not visible to company administrators. An explicit contribution is required before private information enters the company record.
A company has its own record.
Every record belongs to one company, and two separate boundaries keep companies apart: one in the application and one in the database. Facts extracted from your sources are protected the same way as the sources.
Connection credentials stay out of answers, prompts and API responses. Reading a record does not give a person or an agent permission to act on it.
Keep the meaning, not a second document archive.
Connected documents and messages are temporary by default. The lasting record keeps facts and references. Other information has its own reason to stay.
InformationWhat is collectedWhat stays
Connected sources
What is collectedAuthorized documents, messages and business records from the tools you connect.
What staysExtracted facts, summaries and source references. Raw documents and messages are temporary by default; authorized evidence can be fetched again.
Accounts and workspaces
What is collectedIdentity, membership, roles, preferences and connection settings needed to provide the service.
What staysWhat is needed for sign-in, administration and access, until the account or company is deleted.
Questions and conversations
What is collectedQuestions, responses and the conversation context needed for follow-up work.
What staysConversation history until you delete it, or until the retention period your company has set.
Actions and security events
What is collectedWho acted, what was requested, which rules applied and the recorded decision or outcome.
What staysAudit history and receipts. These are kept longer than source content because they are the company’s record of what happened.
Temporary originals do not mean nothing is stored. Extracted facts can still contain sensitive information.
Read the privacy policyA permission to read is not a permission to act.
People and agents face the company’s checks before an important action goes out. If a required check cannot complete, the action is held.
Policies & approvalsBefore the action
Check authority and company rules. Hold when a required answer is missing.
After the decision
Keep who decided, who approved and which rules applied. Corrections add to the history.
Checks can hold the actions you send through them. Activity only learned about afterward can be recorded, but cannot be stopped.
Know where the information lives.
Where data rests and where software runs are different requirements. Agree both before connecting the business.
Managed hosting
The default operated service uses Google Cloud in US regions. Dedicated hosting and other data-region requirements are scoped with the team.
Customer-owned storage
A scoped engagement can keep data at rest in your environment, with private connectivity to the service. Processing still takes place in the service’s environment.
Always centrally hosted in US regions
Accounts · Sessions · Billing · Web interface
Company records and storage
Managed hosting, or dedicated hosting and customer-owned storage by agreement
Review the controls, not a row of badges.
No SOC 2 attestation or ISO 27001 certification is currently claimed. Start with the requirements and the evidence available to assess them.
Your data
Sources, permissions, retention and deletion requirements.
Your environment
Hosting region, encryption, key custody and connectivity.
Your providers
Subprocessors, AI data flows, processing terms and training restrictions.
Your evidence
Available assessment evidence and incident-response arrangements.
A verifiable record helps a customer, auditor, insurer or board check what was recorded. It does not certify compliance or prove the action was correct.
Request a security reviewQuestions worth asking.
Practical answers for the people reviewing the service.
Which sign-in and access controls are supported?
Members can use Google sign-in, passwords or passkeys, and add multi-factor authentication. Active sessions can be reviewed and revoked. Company roles determine what each member can read and do.
How is information encrypted?
In transit, always. At rest, with the cloud provider’s encryption, and credentials for connected tools are encrypted separately for each company. Ask about key custody and customer-managed keys during your review.
Does learning about the business train a model on our data?
No. The record grows from connected evidence and recorded outcomes, not from training models on your conversations. External AI providers process the content of a request to answer it. Their data-use, retention and no-training terms are part of your security review.
Can we review your subprocessors?
Yes. Request the current subprocessor register during your security review. Confirm which providers receive which information and the processing terms that apply to your deployment.
Does disconnecting a source delete everything learned from it?
No. Disabling a connection stops new collection, but does not automatically erase extracted facts or required history. Retention, privacy and deletion processes govern those records separately.
Read the privacy policy
Can the entire service run in our own cloud?
Full customer-hosted and air-gapped installations are not currently offered. Dedicated hosting and customer-owned storage are scoped engagements. Customer-owned storage changes where data rests; processing stays in the service’s environment, and accounts, sessions, billing and the web interface remain centrally hosted in US regions.
Are you SOC 2 attested or ISO 27001 certified?
No SOC 2 attestation or ISO 27001 certification is currently claimed. Framework mappings and verifiable records can support a review, but do not replace independent assurance. Ask for the current assessment status and available evidence.
Explore compliance frameworks
What does a verified receipt establish?
Verification checks the integrity of a recorded event or shared packet. It does not establish that the underlying action was correct, that every event was captured or that the company is compliant.
Receipts & verification
What happens if we leave?
You can export your company’s record and then request deletion. The export, the deletion process and its timing are set out in the agreement and the privacy policy, and private member data is deleted with the member.
Read the privacy policy
Found a security concern?
Send the affected feature and steps to reproduce the issue. Keep credentials and private customer content out of your report. Reports are acknowledged; good-faith research that follows this guidance will not be met with legal action.
security@orcinta.com