Encryption
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Tenant Isolation
Strict per-tenant data isolation — no cross-tenant data access.
Access Control
Role-based access control governs dashboard and API key management.
Orenyx does not hold SOC 2, ISO, or HIPAA certification. Our protections are data isolation, tenant separation, API-key security, bot sandboxing, and audit logs.
Starter
Best-effort uptime.
Growth
99.9% uptime target.
Enterprise
99.95%+ uptime target, under a custom SLA-backed contract.
Current platform status and any active incidents are published on our Status page. In the event of an incident affecting customer data or service availability, affected customers are notified as part of our incident response process.
Scoped Keys
API keys are scoped per environment and tenant, and can be rotated at any time via the API key management endpoint.
Signed Webhooks
Webhook payloads are signed with an HMAC signature header so recipients can verify authenticity.
Rate Limiting
Per-plan rate limits protect the platform and other tenants from overload; Enterprise plans support custom limits.
Usage is metered transparently across dispatch events, bot executions, payment decision calls, and API requests. Sandbox environments are provided with test API keys, and sandbox activity does not incur usage charges or count toward billed events.