Skip to content

Security taken seriously, explained plainly.

Ordo holds your company’s work: customer requests, contracts, production alerts. That’s why every architectural decision starts with who can see what — and with keeping a record of who did what.

Isolation between companies

  • Workspace scoping enforced on every query, with access policies and automated isolation tests.
  • API tokens scoped per workspace; one login across many companies without mixing data.
  • Confidential tasks: only participants can read the content, not even admins.

Access and identity

  • Passwords and tokens stored only as hashes.
  • Sign in with Google via OpenID Connect with minimal scopes: openid, email and profile.
  • Cloudflare Turnstile and rate limiting on sign-in, sign-up and recovery screens.
  • Revocable sessions and Google Workspace domain restrictions per company.

Audit trail

  • Every change records who acted — person, integration, AI agent or system — what changed and when.
  • Agent actions appear as “agent on behalf of” a person.
  • Retention from 7 to 365 days depending on plan, or custom on Enterprise.

Data in transit and at rest

  • HTTPS with HSTS across the entire service.
  • Attachments served through signed, expiring links.
  • Signed outbound webhooks so the receiver can verify the source.
  • The widget and extension strip tokens, emails, tax IDs and card numbers from technical logs and mask passwords in screenshots.

Responsible AI

  • No customer content is ever used to train models.
  • Ordo never sends data to AI providers on its own.
  • The MCP server has no delete tool and flags sensitive actions.

Where it runs

  • In the Ordo cloud or on your own infrastructure (self-hosted), with the same code.
  • MariaDB, PostgreSQL or SQLite; inbound email via Amazon SES or Postfix.
  • Backups and error monitoring with sensitive data scrubbed.

Privacy and compliance

LGPD

Processor of customer data, an appointed Data Protection Officer and access logs kept under the Marco Civil da Internet (Brazil’s Internet Civil Framework).

GDPR and UK GDPR

Data Processing Agreement, standard contractual clauses for transfers and support for data subject requests.

CCPA/CPRA

Service provider: we don’t sell or share personal information, and we honor Global Privacy Control.

Google and Chrome Web Store

Compliant with the Google API Services User Data Policy, including the Limited Use requirements.

Documents for your legal team

Request a signed DPA

Found a vulnerability?

We welcome responsible disclosure. Email [email protected] with steps to reproduce. We’ll respond as quickly as possible and won’t take action against good-faith research that respects customer data.