Protect every sign-in.
Prove it to procurement.
OrbitID sits between your app and every identity provider your customers use. Here is how we protect each sign-in, each directory and each key, and the reports that prove it.
- Audited every year by an independent firm
- SOC 2 Type II
- DPA with standard contractual clauses
- GDPR & CCPA
- At rest, with TLS 1.2+ everywhere in transit
- AES-256
- Uptime SLA, reported on a public status page
- 99.99%
Check every assertion before it counts.
SAML is old and full of sharp edges. We run each response through the same checks, in the same order, and reject it the moment one fails. Your app only ever sees a verified profile.
- 01Signed by your certificateSigned by the certificate you registeredNever the one embedded in the response
- 02Exactly one signed assertionExactly one signed assertionStops XML signature wrapping before parsing
- 03Issuer and audience matchIssuer, audience and recipient matchMeant for this connection and your app only
- 04Inside its time windowInside its time windowNotBefore and NotOnOrAfter, with tight clock skew
- 05Never seen beforeNever seen beforeOne-time assertion IDs block replayed responses
- 06Email domain verifiedEmail domain verified for this organizationNo one signs in as someone else's user
Enterprise security
on every plan.
There is no enterprise tier for security. Your first connection gets the same encryption, alerts and audit trail as your thousandth.
Encrypted everywhere
AES-256 at rest, TLS 1.2+ in transit, backups too.
Keys kept apart
Signing keys in a managed KMS, rotated often.
We keep less
Identity data only. Delete an org and its data goes too.
SCIM tokens in their lane
One hashed token per directory, revoked on removal.
Signed webhooks
HMAC-SHA256 signed and timestamped events.
No surprise expiries
Certificate warnings 30 days before anything expires.
Limit access.
Log everything.
A small team with narrow access, an outside firm that tries to break in every year, and uptime you can check without asking us.
01Who can touch production
- Employees sign in with SSO and hardware keys
- Production access expires after an hour
- Every session is logged and reviewed
- Access is reviewed every quarter
- New teammates are background checked
- An outside firm pen tests us every year
- Employee sign-in
- SSO with hardware keys
- Production access
- Just in time, expires in an hour
- Every session
- Logged and reviewed
- Access reviews
- Every quarter
- New teammates
- Background checked and trained
- Penetration test
- Yearly, by an outside firm
Found something? We reply within 2 business days.
[email protected]02orbitid.instatus.com
All systems operationalNo downtime in the last 60 days
Degraded for 16 min, 7 days ago
No downtime in the last 60 days
Degraded for 9 min, 19 days ago
Trust center
Skip the paperwork.
It's already done.
Forward these to procurement before they ask. Send us their questionnaire and we will fill it in within three business days.
- SOC 2 Type II reportSecurity and availability · covers the last 12 monthsRequest →
- Penetration test summaryIndependent firm · findings and fixesRequest →
- Data processing agreementGDPR and CCPA · includes standard contractual clausesSign →
- Security questionnaireCAIQ and SIG Lite, already filled inRequest →
- SubprocessorsEvery vendor that touches data, with 30 days' notice of changesRequest →
