Security & Trust Center
At MyOrbit, security isn't an afterthought—it's the foundation of everything we build. We employ enterprise-grade security measures, cutting-edge encryption, and continuous monitoring to protect your data and privacy.
This page outlines our comprehensive security practices, certifications, and commitment to keeping your AI twin experience safe and secure.
Table of Contents
1. End-to-End Encryption
Superior E2EE Mode
Our premium encryption mode provides military-grade protection for your conversations:
- Zero Knowledge Architecture: MyOrbit has zero access to your encrypted messages
- Device-Only Storage: Messages stored encrypted on your device only
- AES-256 Encryption: Industry-standard encryption algorithm
- Perfect Forward Secrecy: Each message uses unique encryption keys
- No Server-Side Decryption: We cannot decrypt your messages even if compelled
AI Encryption Mode
Balanced security for AI-powered features:
- In-Memory Processing: Messages processed in secure memory for safety features
- No Permanent Storage: Messages never permanently stored on servers
- Automatic Deletion: Temporary data deleted after processing
- Safety Scanning: Real-time content moderation for user protection
Data in Transit
- TLS 1.3: All data transmitted over encrypted connections
- Certificate Pinning: Prevents man-in-the-middle attacks
- HSTS Enforcement: Forces HTTPS connections
2. Secure Infrastructure
AWS Partnership
MyOrbit is hosted on Amazon Web Services (AWS), one of the world's most secure cloud platforms:
- AWS Security Standards: Benefit from AWS's enterprise-grade infrastructure
- Multiple Availability Zones: Redundancy across geographic regions
- DDoS Protection: AWS Shield for distributed denial-of-service mitigation
- Auto-Scaling Security: Infrastructure scales to handle traffic spikes
NVIDIA AI Security
Powered by NVIDIA's secure AI infrastructure:
- Secure AI Processing: GPU-accelerated encryption and decryption
- Isolated Compute: AI models run in isolated environments
- Model Protection: Proprietary AI models secured against theft
Network Security
- Web Application Firewall (WAF): Blocks malicious traffic
- CloudFront CDN: DDoS mitigation and fast, secure content delivery
- VPC Isolation: Private network segments for sensitive operations
- IP Whitelisting: Restricted access to administrative systems
3. Compliance & Certifications
Current Certifications
- SOC 2 Type II: In progress (expected Q1 2026)
- GDPR Compliance: Full compliance with EU data protection regulations
- CCPA Compliance: California Consumer Privacy Act compliance
- COPPA Compliance: Children's Online Privacy Protection Act compliance
Industry Standards
- OWASP Top 10: Protection against critical web application risks
- CIS Benchmarks: Following Center for Internet Security best practices
- NIST Framework: Aligned with NIST Cybersecurity Framework
- ISO 27001: Roadmap for 2026
Regular Audits
- Third-Party Security Audits: Annual penetration testing
- Code Reviews: Automated and manual security code reviews
- Vulnerability Scanning: Continuous automated scanning
- Compliance Reviews: Quarterly compliance assessments
4. Access Controls
User Account Security
- Multi-Factor Authentication (MFA): Optional 2FA for added protection
- Strong Password Requirements: Minimum 8 characters, complexity enforcement
- Session Management: Automatic logout after inactivity
- Device Management: View and revoke access from unknown devices
- Login Notifications: Alerts for new device logins
Internal Access Controls
- Principle of Least Privilege: Employees have minimum necessary access
- Role-Based Access Control (RBAC): Access granted based on job function
- Background Checks: All employees undergo security screening
- Access Logging: All internal access logged and auditable
- Regular Access Reviews: Quarterly reviews of access permissions
5. 24/7 Security Monitoring
Real-Time Threat Detection
- SIEM System: Security Information and Event Management
- Intrusion Detection: Automated alerts for suspicious activity
- Anomaly Detection: Machine learning identifies unusual patterns
- DDoS Monitoring: Continuous monitoring for distributed attacks
Security Operations Center (SOC)
- 24/7/365 Monitoring: Round-the-clock security team
- Incident Triage: Rapid response to security events
- Threat Intelligence: Stay ahead of emerging threats
- Log Analysis: Continuous analysis of system logs
6. Incident Response
Incident Response Plan
We maintain a comprehensive incident response plan with defined procedures for:
- Detection: Rapid identification of security incidents
- Containment: Immediate isolation of affected systems
- Eradication: Removal of threats and vulnerabilities
- Recovery: Restoration of normal operations
- Lessons Learned: Post-incident analysis and improvements
User Notification
- Breach Notification: Notification within 72 hours of discovery
- Transparency Reports: Annual security and transparency reports
- Status Page: Real-time system status at status.myorbit.ai
7. Data Protection
Data Backup & Recovery
- Automated Backups: Daily encrypted backups
- Geographic Redundancy: Backups stored in multiple regions
- Point-in-Time Recovery: Restore data to any point in time
- Disaster Recovery: Comprehensive DR plan with <4 hour RTO
Data Minimization
- Collect Only What's Needed: Minimal data collection practices
- Automatic Deletion: Old data purged on schedule
- User Control: Delete your data at any time
- Data Portability: Export your data in machine-readable format
8. Bug Bounty Program
Responsible Disclosure
We welcome security researchers to help keep MyOrbit secure. Our bug bounty program rewards responsible disclosure of security vulnerabilities.
Program Details
- Eligibility: All security researchers welcome
- Scope: All MyOrbit web, mobile, and API endpoints
- Rewards: $100 - $10,000+ based on severity
- Hall of Fame: Public recognition for contributors
How to Report
If you discover a security vulnerability:
- Email security@myorbit.ai with details
- Include steps to reproduce the vulnerability
- Allow us 90 days to address before public disclosure
- Do not access user data or disrupt services
Safe Harbor
We will not pursue legal action against researchers who:
- Follow responsible disclosure guidelines
- Avoid privacy violations and service disruption
- Make good faith efforts to comply with our policies
9. Best Practices for Users
Protect Your Account
- Use Strong Passwords: Minimum 12 characters, mix of letters, numbers, symbols
- Enable 2FA: Add an extra layer of security to your account
- Beware of Phishing: MyOrbit will never ask for your password via email
- Review Active Sessions: Check Settings → Security → Active Devices
- Keep Apps Updated: Always use the latest version of MyOrbit apps
Privacy Settings
- Choose Encryption Mode: Enable Superior E2EE for maximum privacy
- Control Visibility: Manage who can see your profile and AI twins
- Review Permissions: Regularly audit app permissions
- Block Unwanted Users: Use blocking and reporting features
Parental Controls
- Link Accounts: Parents can monitor minor accounts
- Content Filters: Age-appropriate content filtering
- Activity Alerts: Notifications for concerning activity
- Screen Time Limits: Set daily usage limits
10. Security Contact
Report a Security Issue
If you discover a security vulnerability or have security concerns:
- Email: security@myorbit.ai
- PGP Key: Available at myorbit.ai/.well-known/pgp-key.txt
- Response Time: We respond to all security reports within 24 hours
General Security Questions
For non-urgent security questions or feedback:
- Email: trust@myorbit.ai
- Documentation: Visit our Security Documentation
Enterprise & Compliance
For enterprise security assessments and compliance inquiries:
- Email: enterprise@myorbit.ai
- Request SOC 2 Report: Available for enterprise customers
- Security Questionnaires: We respond to vendor security assessments