Orbit holds the operational record of who works where and when — your people trust you with that, and you're trusting us.This page explains exactly what Orbit stores, how it's protected, what HAL can and cannot see, and the straight answers to the questions your IT reviewer will ask.
Orbit stores operational scheduling data: the same class of information as your staffing spreadsheet, held with far better access control.The boundaries are structural — there is no patient entity anywhere in the data model, and no place to put the sensitive records Orbit doesn't need.
Every read of a schedule requires the requester to be an authenticated, invited member of that specific schedule — enforced in the database's own security rules.Even a bug in the interface couldn't expose one organization's data to another.Every server endpoint independently verifies the caller's identity token.
All traffic runs over TLS 1.2+; data at rest is AES-256 encrypted on Google Cloud.The underlying infrastructure — including the database itself — is certified under ISO 27001 and SOC 1, 2, and 3 as part of Google's compliance program.
Owner, editor, site lead, and viewer roles control who can change the schedule, who can manage settings, and who can only look — plus a scoped-editor tier that narrows editing rights to one role or site slice, enforced on the server, not just in the interface.Invitations are bound to a specific email and expire; join codes open exactly one schedule, are rate-limited against guessing, and can be regenerated at any time.
Every modification — a schedule edit, a time-off approval, a publish — is logged with who did it, when, and the before-and-after values.Retention is configurable per organization, and a legal-hold flag suspends all automated cleanup during audit or accreditation windows.
Automated daily backups plus on-demand snapshots, with the last ten retained per schedule.Restores are non-destructive: a restore takes its own safety snapshot first and never overwrites the audit log.
There are no API keys or credentials in the browser.Every third-party key — HAL's model provider, email, SMS, billing — is held in Google Secret Manager and used only by server-side functions.Billing runs through Stripe; card details never touch Orbit's systems.
Sign-in is one field.Type your email, and if your device holds an Orbit passkey, the browser offers it right there — one Face ID or Touch ID tap and you're in.Passkeys are phishing-resistant by construction: the credential lives on your device, Orbit's servers store only the public half, and there is no password to steal or reuse.Enrollment is a one-time invitation after sign-in, and passkeys are managed — renamed, removed — from your own account settings.
And nobody gets locked out.Every sign-in surface carries an email rescue door: a one-time code and link, born together, single-use, short-lived, and used once — two taps still give one sign-in.The links are built for clinic reality: corporate email scanners that pre-click every URL spend nothing, because redemption only happens when a human acts on the page.On iPhone and Android, sign-in links open the Orbit app directly, not a browser tab.
Orbit's assistant, HAL, runs entirely server-side.Your staff's devices never communicate with the model provider directly, and there is no model key in the browser to leak.When HAL answers a question, it receives the minimum scheduling context needed — your schedule, never another customer's, and never patient data.
HAL's language model comes from Anthropic, under commercial terms that prohibit training on customer data.The provider keeps inputs only for a limited time for abuse screening; they are not reused or used to train models.Automated scanners at every input boundary (voice capture, document upload, request text) flag anything shaped like protected health information before it goes anywhere.
Service providers.Google Cloud (hosting and database) · Anthropic (HAL's language model) · SendGrid (email) · Twilio (text messages) · Stripe (billing).
What HAL is allowed to do is governed by a published trust framework: every action logged with a complete before-and-after record, one-click reversal, and hard validation before anything is written.Read it at The Orbit Standard.
Export anytime.Schedules export to Excel on demand, and a full data-export function returns everything associated with a user on request.
When someone leaves your team, removing them ends their access immediately — membership is checked live on every read.Their identifying history can be anonymized while the operational record your program needs stays intact.
When you delete data, it's actually deleted.Account deletion removes or anonymizes personal data with an audit trail.Schedule deletion cleans up every orphaned reference — join codes, notifications, index entries — rather than leaving them behind.
Security pages tend to go vague exactly where reviewers need precision.Here's where Orbit actually stands.
The infrastructure Orbit runs on — Google Cloud and Firebase — holds ISO 27001 and SOC 1/2/3 certifications.Orbit as a company has not yet completed its own SOC 2 audit.It's planned as Orbit grows, and the controls it audits — access control, audit logging, change management — are already in place.In the meantime, we'll gladly walk your IT team through the architecture and answer security questionnaires directly.
Orbit doesn't handle protected health information, so HIPAA's vendor obligations don't attach.There are no patient records in Orbit — structurally, not just by policy.A BAA covers vendors that process PHI on your behalf; Orbit sits in the same category as your staff-scheduling spreadsheet or HR system, not your EMR.If your organization's policy requires one regardless, we have a BAA ready to sign.
Sign-in supports passkeys — phishing-resistant, one Face ID or Touch ID tap, no password to steal — plus Google and Apple accounts, which inherit those providers' security policies, including any multi-factor enforcement your organization has set, and email and password with a rescue flow that can't lock anyone out.New passwords must be at least 12 characters.Orbit-native TOTP-style MFA and SAML SSO aren't built yet.They're honest roadmap items, prioritized when an enterprise deployment needs them.
Orbit is operated by DCR LLC, a small Illinois company, and infrastructure administrators can access production data for support and operations — the same as any early-stage vendor, and we'd rather say so than pretend otherwise.What makes it accountable: every modification is audit-logged, third parties receive data only for their specific function, there are no shared logins or client-side secrets, and every account that administers Orbit's cloud, code, domain, payments and text messaging requires two-factor sign-in.As the team grows, access controls formalize with it.
Send it over.We answer security reviews directly and quickly — with specifics, not boilerplate.If your IT team wants to talk architecture, we'll get them to someone who can.
hello@orbitscheduling.com