> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useorgx.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Security & Privacy
> OrgX security model: Clerk auth, OAuth 2.1 with PKCE for MCP, row-level workspace isolation, explicit agent scopes, append-only audit log, and configurable autonomy limits. Agents earn trust progressively — no elevated access by default.
At OrgX, security isn't an afterthought—it's foundational to how we build. This page outlines our security posture, data handling practices, and compliance roadmap.
## Data Storage
### Primary Database
OrgX uses **Supabase Postgres** as the primary datastore:
* **Encryption at rest**: All data encrypted using AES-256
* **Encryption in transit**: TLS 1.3 for all connections
* **Row-Level Security (RLS)**: Every table has RLS policies ensuring users only access their own data
* **Backups**: Daily automated backups with point-in-time recovery
### User Data Isolation
```sql theme={"dark"}
-- Example RLS policy
CREATE POLICY "users_own_data" ON initiatives
FOR ALL USING (
owner_id = auth.uid() OR
workspace_id IN (
SELECT workspace_id FROM workspace_members
WHERE user_id = auth.uid()
)
);
```
Every query automatically filters to the authenticated user's data.
***
## Authentication
### User Authentication
OrgX uses **Clerk** for user authentication:
* Email/password with strong password requirements
* Google OAuth
* Passkey support (WebAuthn)
* Multi-factor authentication (MFA) available
### API Authentication
| Surface | Method | Token Type |
| ------------------ | -------------- | ------------------ |
| Web App | Clerk session | Short-lived JWT |
| MCP Server | OAuth 2.1 | Access token (24h) |
| Webhooks | HMAC signature | N/A |
| Service-to-service | API key | Long-lived |
### Session Management
* Sessions expire after 7 days of inactivity
* Concurrent sessions allowed (configurable)
* Remote session revocation available in settings
***
## Secrets Management
### Integration Tokens
Tokens from connected services are stored securely:
| Token | Storage | Encryption |
| ------------------- | --------------------- | ----------------------- |
| Linear access token | `users` table | Column-level encryption |
| GitHub access token | `users` table | Column-level encryption |
| Stripe keys | Environment variables | Platform-managed |
| MCP JWT secret | Environment variables | Platform-managed |
### Key Rotation
| Secret Type | Rotation Frequency | Method |
| ---------------- | ------------------ | ------------------ |
| OAuth tokens | On expiry/revoke | Automatic refresh |
| API keys | Manual | Settings UI |
| JWT signing keys | Quarterly | Rolling deployment |
If you suspect a token has been compromised, revoke it immediately in Settings
→ Integrations and reconnect.
***
## Access Controls
### Role-Based Access
| Role | Permissions |
| ------ | ------------------------------------------------- |
| Owner | Full workspace access, billing, user management |
| Admin | Full access except billing changes |
| Member | Access to assigned initiatives, approve decisions |
| Viewer | Read-only access to dashboards |
### Permission Boundaries
* Agents only access data explicitly granted via scopes
* MCP tools declare required permissions
* Audit log tracks all permission-sensitive actions
***
## Agent Security
### Autonomy Limits
Agents operate within configured boundaries:
```typescript theme={"dark"}
interface AgentLimits {
max_tokens_per_run: number; // Prevent runaway costs
max_tool_calls: number; // Prevent infinite loops
allowed_tools: string[]; // Whitelist of tools
budget_threshold: number; // $$ limit before escalation
}
```
### Tool Gating
```typescript theme={"dark"}
// Tools are gated by scope and policy
const registry = buildPolicyAwareToolRegistry({
requestedTools: ['github.create_pr'],
grantedScopes: user.scopes, // Must include 'github:write'
projectId: project.id,
});
```
### Verification Layer
Every artifact passes through verification before shipping:
1. Citation check (sources exist and are accessible)
2. Policy check (no PII, no secrets, brand compliant)
3. Contract check (output matches expected schema)
4. Budget check (within token/latency limits)
***
## Audit Trail
### What We Log
| Event Type | Data Captured |
| -------------- | -------------------------------------------- |
| Authentication | User ID, timestamp, method, IP |
| API calls | Endpoint, params, response code, duration |
| Agent runs | Tools called, tokens used, artifacts created |
| Decisions | Action taken, user, timestamp, note |
| Data access | Table, row IDs, operation |
### Retention
| Log Type | Retention |
| ---------------- | ---------- |
| Security events | 12 months |
| Agent telemetry | 90 days |
| Decision history | Indefinite |
| API access logs | 30 days |
### Access to Logs
* **Mission Control**: View recent activity
* **Settings → Audit Log**: Full searchable history
* **Export**: Download logs for compliance reviews
***
## Network Security
### Infrastructure
* **Hetzner**: Application and agent runtime hosting
* **Cloudflare**: MCP server, edge protection, DDoS mitigation, and WAF
* **Supabase**: Managed Postgres with network isolation
### Security Headers
All responses include security headers:
```typescript theme={"dark"}
// middleware.ts
headers.set('X-Content-Type-Options', 'nosniff');
headers.set('X-Frame-Options', 'DENY');
headers.set('X-XSS-Protection', '1; mode=block');
headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
headers.set('Content-Security-Policy', CSP_POLICY);
```
### Rate Limiting
| Endpoint | Limit | Window |
| -------------- | ------- | ------ |
| Auth endpoints | 10 req | 1 min |
| API reads | 100 req | 1 min |
| API writes | 30 req | 1 min |
| MCP tools | 60 req | 1 min |
***
## Incident Response
### Response Process
1. **Detection**: Automated monitoring + user reports
2. **Triage**: Severity assessment within 1 hour
3. **Containment**: Immediate action to limit impact
4. **Resolution**: Root cause fix and deployment
5. **Communication**: User notification if data affected
6. **Review**: Post-incident analysis and improvements
### Contact
Report security issues to: [security@useorgx.com](mailto:security@useorgx.com)
We respond to all security reports within 24 hours.
***
## Compliance Roadmap
### Current State
| Compliance | Status |
| ------------- | ------------------------------------- |
| GDPR | ✅ Data minimization, deletion, export |
| CCPA | ✅ Opt-out, access requests |
| SOC 2 Type I | 🔜 In preparation |
| SOC 2 Type II | 🔜 Following Type I |
| HIPAA | ❌ Not applicable (no PHI) |
### Data Processing
* **Subprocessors**: Hetzner, Cloudflare, Supabase, Stripe, OpenAI
* **Data location**: Primary application/runtime infrastructure on Hetzner; managed data storage in Supabase; enterprise region commitments available on request
* **DPA**: Available on request for enterprise customers
### Your Rights
You can:
* **Export** all your data (Settings → Export)
* **Delete** your account and data (Settings → Account)
* **Correct** inaccurate data (Settings → Profile)
* **Restrict** processing (contact support)
***
## Best Practices
Multi-factor authentication significantly reduces account takeover risk.
Enable it in Settings → Security.
{' '}
Periodically review which integrations have access. Remove any you no longer
use in Settings → Integrations.
{' '}
Grant agents and team members only the permissions they need. Start
restrictive and expand as needed.
Regularly review the audit log for unexpected activity, especially after
onboarding new team members or integrations.
***
## Questions?
Report vulnerabilities or ask questions.
Full privacy policy.