Security

Security is part of how Orcastrator is built: identity-aware access, encrypted transport, environment separation, and controls that scale from self-serve plans to enterprise deployments.

This page summarises practices that apply today. For questionnaires, penetration-test summaries, or formal assurance packages, contact sales@orcastrator.qa.

Public endpoints are served over HTTPS / TLS. The marketing site enforces secure requests (including upgrade-insecure-requests in its content security policy) and ships standard browser hardening headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy).

Product traffic between browsers, APIs, and agents is expected to use TLS. Live execution updates use authenticated realtime channels (SignalR) over the same secured application surface.

Orcastrator supports:

• Self-service signup with email verification and guided onboarding
• Microsoft Entra ID SSO with JIT and SCIM provisioning, group-to-role mapping, and verified-domain discovery
• Role-based access and tag-based filtering so teams only see the projects, suites, cases, orchestrations, and runs they are scoped to
• Enterprise capabilities for advanced RBAC and audit logs

Organisations remain responsible for joining the correct identity provider configuration and for reviewing who has admin privileges.

Product workspaces may contain blueprints, specs, versioned test cases, orchestration definitions, run results, and execution evidence (including step output and screenshots). Access is gated by project and role controls.

Plan-level data retention windows apply to applicable product data (as described on pricing: from 14 days on Hobby up to 365 days on Enterprise). Configure retention expectations with your administrator and agreement.

Do not store production secrets in free-text fields you are not authorised to share. Prefer environment variables and secret stores your organisation already controls when configuring agents.

Orcastrator can be used with:

• Public cloud tenancy
• Private cloud options for stricter isolation needs
• Hybrid / on-premises agents that execute in your AWS, Azure, GCP, or on-prem environment while reporting into Orcastrator

When agents run in your infrastructure, you retain control of network egress, secrets, and local data that never leaves your environment.

• Marketing APIs validate inbound contact payloads and escape HTML before rendering into email templates
• Server-side secrets (for example email API keys) stay off the browser bundle
• Billing card data is handled by Stripe; Orcastrator does not store full card numbers
• Sonar AI suggestions remain under human review before published versions ship

Orcastrator is ISO/IEC 27001 certified(opens certificate in a new tab) (Global Inter Certification / GIC). We also design controls with common enterprise frameworks in mind (including SOC 2 control themes, GDPR expectations for personal data, and healthcare-adjacent customer requirements). Request current attestation reports, BAAs, or questionnaires from sales@orcastrator.qa so you receive scoped, dated artefacts rather than assumptions from the website alone.

Personal data practices are described in our Privacy Policy. Processor commitments are in the DPA.

If you believe you have found a security issue, email security@orcastrator.qa with enough detail to reproduce the issue. Do not include production secrets, customer personal data, or proof-of-concept payloads that could harm other tenants. We triage reports on business days and will follow up by email.