Security and data protection

Hosted in Canada

Your account and financial projections are hosted in Canada, in Montréal. All traffic with Orbinance is encrypted (HTTPS).

Access to your account

• Passwords stored hashed, never in plain text.
• Optional two-step verification with an authenticator app (Settings › Security).
• Bot protection on sign-up, sign-in and password reset.
• Automatic sign-out after 10 minutes of inactivity, with a warning first.
• A list of your signed-in devices and recent sign-ins in Settings › Security.
• Email address changes confirmed by email.

Access to your data

• Each account only sees its own companies and those it was invited to: the rule is enforced by the database itself.
• Owner, editor and viewer roles; share links are read-only and can be revoked anytime.
• Xero connections are read-only, and their access keys are stored encrypted on our server.
• The AI connector only sees what you authorize, and every change made by an AI is labelled and can be undone.

History and recovery

• Version history for every budget and every company; the owner can restore a version.
• Everything is kept for 7 days, then one version a day for 90 days, then one a month; the latest 50 versions are always kept.
• You can download all your data or delete your account anytime (Settings › Account › Your data).

Website and app

The website and the app enforce a strict content security policy: only the services needed to run can be loaded. No advertising cookies. The website counts its visits anonymously and without cookies (Vercel Web Analytics); detailed usage measurement (PostHog) only starts with your consent, and always masks text and amounts.

Law 25 and incidents

John-Frederick Davidson is the person in charge of the protection of personal information (info@orbinance.com). If a confidentiality incident presents a risk of serious injury, we will notify the people concerned and the Commission d'accès à l'information. To report a vulnerability, write to info@orbinance.com.