Public security and trust statement
Security Policy
Effective date: November 4, 2026
Security is part of Orbit's product design. This public policy summarizes safeguards BAM Meridian LLC uses to protect Orbit and user data. It is intended as a trust and transparency document and does not disclose sensitive implementation details that could weaken security.
1. Security Principles
- least-privilege access and separation between public/client and privileged server operations;
- privacy by design and data minimization;
- defense in depth across authentication, application, database, and notification layers;
- secure handling of secrets and credentials;
- logging and monitoring appropriate to operational and security needs;
- regular review as the product and threat landscape evolve.
2. Authentication and Account Security
Orbit supports authenticated accounts and currently includes email/password and Google authentication. Authentication flows are designed not to disclose whether an email address has an Orbit account. Privileged credentials are not embedded in the browser. Users should protect their credentials and notify us promptly of suspected unauthorized access.
3. Data Access Controls
Orbit's production database uses row-level security on user-facing and internal application tables. Authorization rules are designed so users can access only data they are permitted to access, while privileged service operations are restricted to server-side functions. Administrative and growth reporting surfaces are access-controlled and designed around aggregate reporting rather than exposing individual-user analytics rows.
4. Encryption and Transport
Orbit uses encrypted HTTPS/TLS transport for data transmitted between supported clients and the Service. Infrastructure providers may also apply encryption and security controls to stored data. We do not publish cryptographic keys, secrets, or internal credentials.
5. Secrets and Notification Security
Sensitive server credentials, including notification-dispatch secrets and private push keys, are kept out of client-side code. Orbit's Focus notification system uses authenticated server-side dispatch, controlled claims and retries, cancellation checks, and minimal notification content designed not to expose task, list, or reflection text on a lock screen.
6. Analytics Privacy and Security
Orbit's first-party analytics uses a controlled event dictionary. The analytics schema is designed to reject undeclared properties and exclude user-entered free text such as task text, reflection text, habit names, list names, and email addresses. Privileged ingestion and reporting operations run server-side.
7. Service Providers
We select infrastructure and service providers based on product requirements and security considerations and limit their access to what is reasonably necessary. Our Privacy Policy and data-processing documentation describe relevant processing relationships and are updated as the vendor stack changes.
8. Backups, Availability, and Recovery
Orbit relies on managed cloud infrastructure and operational controls intended to support availability and recovery. We test critical launch flows and maintain separation between development/staging and production where applicable. Specific recovery objectives and backup-retention commitments should not be inferred unless expressly published.
9. Vulnerability Reporting
If you believe you have found a security vulnerability in Orbit, please email [email protected] with enough detail for us to reproduce and investigate it. Do not access, alter, or download data that does not belong to you; do not degrade the Service; and allow reasonable time for investigation before public disclosure. We appreciate good-faith security research.
10. Incident Response
We investigate suspected security incidents, take reasonable containment and remediation measures, and notify affected users and authorities when required by applicable law. Our response may include credential or token revocation, access restriction, vendor coordination, forensic review, and corrective engineering work.
11. User Responsibilities
- use a strong, unique password where password authentication is used;
- keep devices and browsers updated;
- do not share credentials;
- review notification and device settings on shared devices;
- contact us if you suspect unauthorized access.
12. Changes
We may update this Security Policy as Orbit's architecture and safeguards evolve. Material changes will be reflected by an updated effective date.