Security

The Oryon Data platform and its PostgreSQL database run on Google Cloud Platform in the northamerica-northeast1 region (Montréal, Québec, Canada). That choice is deliberate: it keeps customer data in Canada.

The oryondata.com website is hosted by Vercel. Network and content delivery services are provided by Cloudflare. Payment processing is handled by Stripe and artificial intelligence features by OpenAI; those providers may process data outside Canada, primarily in the United States.

The platform exposes no public access to its database: the connection runs over an authenticated, encrypted channel between the application service and the database instance, with no open authorized network.

Data in transit is encrypted using HTTPS/TLS. The website and the platform are served over HTTPS only and send strict security headers, including HSTS.

Data at rest is encrypted by Google Cloud's storage layer, which covers the database and its backups.

Access to production systems is restricted to authorized members of the Oryon team and relies on individual identities rather than shared accounts. Multi-factor authentication is enabled on administrative accounts where the provider supports it.

Application services run under dedicated service accounts whose permissions are limited to the operations they need. API keys, secrets and access tokens are held in Google Secret Manager and injected at runtime; they never appear in source code or in the repository.

Access to a workspace relies on signed sessions, carried in a secure cookie and restricted to the platform's trusted origins.

When a user connects a third-party platform, authorization goes through OAuth. Oryon never requests, sees or stores the passwords to its users' third-party accounts. OAuth tokens are held as secrets and are deleted when the source is disconnected.

Every Oryon integration is established read-only. The permissions requested from Google, Meta, Shopify, HubSpot, LinkedIn and TikTok are read scopes: Oryon does not create, modify, publish or delete anything in its users' accounts.

The only write permission Oryon requests is Google's drive.file scope, used solely when a user asks to export a report to Google Slides. That scope grants access only to files Oryon itself created and does not allow Oryon to read, modify or delete any other file in the user's Drive.

The exact scopes requested from each platform, and the precise fields read from them, are enumerated in the Privacy Policy.

Data is attached to the workspace that connected it, and every read is scoped to the authenticated user's workspace. Nothing is pooled across customer organizations, and no customer's data is visible to another.

Roles within a workspace govern what a member can view and change.

The production database is backed up automatically every day, retained on a rolling seven-day window.

Backups are held by the cloud provider in the same region as the database and are encrypted at rest.

Application errors are collected and monitored so failures are caught quickly. Access logs and scheduled-job execution logs are retained by the cloud platform.

Logs are used for diagnostics, security and service-usage measurement only. Access to production logs is subject to the same restrictions as access to production systems.

Oryon relies on technology providers for hosting, networking, artificial intelligence, payments, monitoring and transactional email. Each is governed by its own terms and data processing agreement.

The principal providers involved in delivering the service are listed in the Privacy Policy. For the complete, current list of our subprocessors, write to privacy@oryondata.com.

Data is retained for as long as necessary to deliver the service. Disconnecting a source immediately deletes the corresponding access token and stops any further retrieval; metrics already collected remain in the workspace so the source can be reconnected without losing history.

Deleting a workspace or an account permanently deletes the associated data, within thirty (30) days at most. Deletion can be requested at any time at privacy@oryondata.com. Detailed instructions are on the data deletion page.

Oryon maintains a register of confidentiality incidents, as required by Québec's Law 25. Where an incident presents a risk of serious injury, Oryon notifies the Commission d'accès à l'information du Québec and the individuals concerned with diligence, and takes reasonable measures to reduce the harm and prevent recurrence.

Affected customers are informed of any incident involving their data.

If you discover a vulnerability in Oryon's website or platform, write to privacy@oryondata.com describing the issue and the steps to reproduce it. We acknowledge reports and work in good faith with the people who send them.

We ask that you not access other people's data, not degrade the service, and allow us reasonable time to fix the vulnerability before any public disclosure.