SOC2 & GDPR Compliance Statement

OrbitoHQ undergoes rigorous annual SOC2 Type II audits conducted by independent CPA auditing firms. Our SOC2 report evaluates controls across the AICPA Trust Services Criteria:

• Security: Systems are protected against unauthorized physical and logical access.
• Availability: Platform operational metrics meet guaranteed SLA uptime commitments.
• Confidentiality: Confidential tenant data is encrypted and restricted to authorized personnel.
• Processing Integrity: Automated sprint workflows and backlog execution perform accurately without unauthorized modification.

For organizations operating in the European Economic Area (EEA) or United Kingdom, OrbitoHQ acts as a Data Processor under GDPR regulations.

We provide a standardized Data Processing Addendum (DPA) incorporating EU Standard Contractual Clauses (SCCs) to ensure seamless legal cross-border data transfer compliance.

We maintain a continuous vulnerability management program featuring bi-annual external penetration testing, continuous static application security testing (SAST), and container scanning.

Security researchers can responsibly disclose potential security findings to our security team via security@orbitohq.com.

In the unlikely event of a verified security incident or data breach impacting workspace data, OrbitoHQ guarantees notification to affected Organization Owners within 24 hours of incident confirmation, accompanied by mitigation steps and forensic summaries.