Security

How orbslate keeps your credentials and your results where they belong.

Nothing is opened inbound. The agent runs inside your network and dials out to the service.

Your credentials stay on the agent. A kubeconfig stays in your own file; the agent writes down only the context's name and the file's path. The service holds names, versions, tiers and your policy, never a credential, and refuses a request that could carry one.

Results are never kept by the service. With the agent's MCP server, a tool's result goes from the agent to the AI client on the same machine and nowhere else; the service receives the licence check and the policy pull. Through the workspace's gateway (/mcp), the result is masked and fenced on the agent first, then passes through the service to your AI client, and is not stored: the workspace's audit keeps who asked, what, and how it was decided, with the arguments masked. Secrets in a result (a Secret's values, a token in a log line) are masked on the agent before your AI client sees them.

Every call is your role's decision, made on the agent with a policy the service signs and the agent verifies, and a row in the agent's own audit. A call through the gateway is decided at the gateway first and again on the agent, with your role bounded by the role of the member who paired the agent.

The agent is open to inspection. It is a compiled program that unpacks; nothing in it pretends to be a secret. It checks its licence once a day and holds the last good answer for seven days offline; after that it runs no tools and says why.

What is kept, and for how long

The service: Your account: your address, a salted hash of your password (never the password), when you confirmed the address and last signed in, and wrong-password counts for the lockout; until you delete your account
The service: Your sign-ins: a hash of each browser's session token and when it was last used; 30 days from its last use, or until you sign out
The service: The links we mail or show you (to confirm an address, reset a password, join a workspace or sign up) and the codes that pair an agent: a hash of each, whom it is for and when it was used; for a pairing, the machine's name and platform; as a record after use; each works only until it is used or expires (2 hours for a reset, 3 days to confirm, 7 days for an invitation, 10 minutes for a pairing code)
The service: Your workspaces: their names, members and roles, the environment rules and each published policy, a hash of each API token with its name, and each workspace's plan and, once it pays, the ids of its Stripe customer and subscription, the subscription's status and its seats. The card and the invoices are Stripe's: we never see a card number; until the workspace is deleted, which cancels its subscription first
The service: The ids of the payment events Stripe sends us, so none is applied twice: the id, its type and when it came, never what it said; 30 days
The service: Your agents and connections: each machine's name, version, platform, when it last checked in and which model its runs use (never the model's key); each connection's kind, name, environment, tier and what its agent reported (version, namespaces), never its credential; until the workspace is deleted
The service: The apps you let into a workspace through sign-in (claude.ai, Claude Desktop): each app's name as it gave it, where its access goes, what it may do, and when it was let in and last used; the access itself is kept only as hashes and encrypted; until you disconnect it or the workspace is deleted; its access ends when you disconnect it
The service: A database's map, where an agent reflected one: its tables' and columns' names and types, its keys, indexes and comments, and the database's own row estimates, never a row and never a credential; until the connection is removed or the workspace is deleted
The service: What the map means: the tags and join hints people applied to its columns, the proposals waiting for a person (each tag and hint with its reason), a history of what each apply changed and who applied it, and the masking an Owner set for a tag of the vocabulary, with who set it and when; until the workspace is deleted; a column's tags and hints go with its connection
The service: A write that waits for a second person's approval: the tool, where it acts, the reason, who asked and who decided, and what it answered once it ran; its arguments as they were asked only while it waits, and as the audit keeps them (secrets masked) after; until the workspace is deleted; the arguments as asked go when it runs, is declined, or expires after 30 minutes
The service: The workspace's audit: a row per tool call through its gateway (and per call its agents upload, where the plan keeps the audit in the service): when, who asked (the member and the token, or the agent), the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, whether personal values were shown, the arguments with secrets masked, never a result; 7 days on Solo and 90 on Team; on Enterprise as its contract says, a year until it says otherwise. An hourly sweep deletes what is older, and everything goes with the workspace
The service: The address a sign-up or a password reset came from, counted to refuse a flood; and a count of the mail sent each day; an address's count is dropped once it is an hour old, the next time that address is counted; the daily count holds no address
The service: The service's own settings, such as whether sign-ups are open; until changed
The service: A copy of the service's database, taken daily, to recover from a disaster; 30 days
The host: Request lines and errors in the host's logs (Cloudflare), never a request's body; the host's rolling window
The service: Playbooks: each one's name, its text (the schedule, the connections it may use, its budget, whether it may act, and what it should do), who made it and who saved it last; until it is deleted, or the workspace is
The service: Run records: when each run of a playbook began and ended, on which agent and with which model (never its key), how many tool calls and tokens, the model's final report with secrets masked on the agent, and each call's audit metadata (the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, the arguments masked), never a result; 90 days; an hourly sweep deletes what is older, and everything goes with the workspace
Your machine: The agent's own copy of each run's record, and the playbooks it was last given; 30 days for the records; the playbooks until the next pull
Your machine: The model key Runs use, in this machine's keyring; the prompts and the tool results of a run go only to the model provider you chose, from this machine; until `model remove`
Your machine: The agent's audit: a row per tool call (when, the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, the arguments with secrets masked), never a result; 30 days
Your machine: The agent's log of its own events, with no secrets and no results; 7 days
Your machine: The map of each database the agent reflected, as it last read it: the same names, types, keys, comments and estimates, never a row; until the connection is removed
Your machine: The tags and join hints applied on this machine, the proposals made here, and a history of what each apply changed; until you delete the agent's folder

Reporting a vulnerability

If you find a way past any of this, write to support@orbslate.com. Tell us what you did and what you saw; we answer every report.