Security at Orca

Last Updated: July 31, 2026

Our Commitment to Trust

At Orca, we understand that we are critical infrastructure. When you integrate our SDK, you are trusting us with your revenue stream and your user relationships. Security is not a feature we add on; it is the foundation of our architecture.

This document outlines the technical and organizational measures we implement to protect your data.

1. Cloud Infrastructure & Edge Architecture

Orca operates a globally distributed edge architecture. Receipt validation and entitlement checks are served via Cloudflare Workers & Pages deployed across 300+ global edge PoPs, ensuring sub-10ms latency for SDK calls. Backend services and persistent data storage run on Amazon Web Services (AWS).

  • Physical Security: Both Cloudflare and AWS maintain industry-leading physical security controls (biometric access, 24/7 surveillance, redundant power).
  • Network Segregation: Backend services are isolated within a Virtual Private Cloud (VPC). Databases and internal services are not accessible from the public internet.
  • DDoS Protection: All traffic is fronted by Cloudflare's network-layer DDoS mitigation, with additional AWS Shield protection for backend services.

2. Data Encryption

We encrypt data at every stage of its lifecycle.

  • Encryption in Transit: All data transmitted between the Orca SDK, Dashboard, and API is encrypted using TLS 1.3. We enforce HSTS (HTTP Strict Transport Security) on all web properties. Cloudflare edge nodes terminate TLS before any data reaches backend services.
  • Encryption at Rest: All data stored in our PostgreSQL databases and object storage is encrypted using AES-256. Key management is handled via AWS KMS (Key Management Service).
  • Payment Credentials: We do not store raw credit card numbers or bank account credentials. Card billing is tokenized via Stripe (PCI-DSS Level 1 Service Provider). European Direct Debit mandates processed via GoCardless are handled exclusively on GoCardless's FCA-regulated, PCI-compliant infrastructure.

3. Application Security

3.1 Authentication & Access Control

  • Dashboard Access: Multi-Factor Authentication (MFA) is enforced for all developer accounts accessing the Orca Dashboard.
  • API Security: SDK and REST API requests are authenticated via scoped, rotatable API keys. Rate limiting is enforced at the Cloudflare edge layer to prevent brute-force attacks and abuse.
  • MCP Server API Keys: Access to the Model Context Protocol (MCP) Server is gated by separately scoped API tokens with configurable permission sets. Read-only and write-scoped tokens are available; we recommend minimum-privilege tokens for all AI agent integrations.
  • Role-Based Access Control (RBAC): Internally, access to customer data is restricted on a "need-to-know" basis. Engineers access production resources through a VPN with MFA enforcement.

3.2 Secure Development Lifecycle (SDLC)

  • Code Review: All code changes require peer review and automated testing before merging.
  • Dependency Scanning: We use automated tools (Dependabot, Snyk) to scan dependencies for known CVEs in real-time.
  • Static Analysis: SAST tools run on every commit to detect OWASP Top 10 vulnerabilities before deployment.

4. Compliance & Certifications

  • GDPR: Orca is fully compliant with the General Data Protection Regulation, including cross-border transfers via Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. See our Privacy Policy for full details.
  • PCI-DSS: As we do not store raw cardholder data or bank account credentials, we rely on Stripe's PCI-DSS Level 1 and GoCardless's FCA-regulated infrastructure. Orca completes a Self-Assessment Questionnaire (SAQ-A) annually.
  • SOC 2 Type II: Orca is undergoing its SOC 2 Type II audit. We expect to publish our attestation report in Q4 2026. Enterprise customers may request a copy of preliminary findings under NDA by contacting security@maxint.com.

5. Vulnerability Disclosure

We welcome responsible disclosure from external security researchers. If you believe you have found a security vulnerability in Orca, please report it to security@maxint.com with a detailed description and reproduction steps.

  • Scope: Our Edge API, REST API, Dashboard, MCP Server, and published iOS/Android/Desktop/Web SDKs.
  • Out of Scope: Social engineering attacks, physical attacks, or vulnerabilities in third-party services (Apple, Google, Stripe, GoCardless).
  • Safe Harbor: We will not pursue legal action against researchers who report vulnerabilities in good faith and in accordance with this policy.
  • Bounties: We offer monetary rewards for confirmed critical vulnerabilities on a case-by-case basis.

6. Incident Response

In the event of a security breach:

  • Containment: Our security team will isolate affected systems immediately.
  • Notification: We will notify affected customers via email within 72 hours of confirming a data breach, in accordance with GDPR and local laws.
  • Transparency: We will publish a post-mortem detailing the root cause and remediation steps once the incident is resolved.

For specific security questionnaires or to request our latest penetration test summary (Enterprise customers only), please contact security@maxint.com.