TRUST · REVIEWED 2026-10-26
Security, availability and data handling, with sources.
Orca is a Maxint service and is covered by Maxint's security program, legal terms and privacy policy. Every row below cites where the commitment is made so you can read the original text yourself.
- Audit
- SOC 2
- Type II verified (Maxint)
- Uptime
- 99.9%
- Scale SLA, with credits
- TLS in transit
- 1.3
- AES-256 at rest
01 · EVIDENCE
Claim and source.
| Area | What is stated | Source |
|---|---|---|
| Service availability | 99.9% monthly uptime commitment for the entitlement validation API and edge gateways on Scale. Credits: 10% below 99.9%, 30% below 99.0%. Covers Orca's own infrastructure; Apple, Google, Stripe and GoCardless outages are outside it. | Orca Product Terms |
| Independent verification | Maxint is SOC 2 Type II verified: an independent CPA firm tested that controls operated effectively over time. The current report is available on request under a confidentiality agreement. | Maxint Security · Trust center |
| Encryption | TLS 1.3 in transit; databases, document storage and backups encrypted at rest with AES-256. | Maxint Security |
| Payment data | Orca validates purchases and tracks entitlements without collecting full card numbers or banking credentials. Apple App Store and Google Play handle in-app payment; Stripe and GoCardless are PCI DSS-certified processors. | Maxint Security · Notes by service |
| Infrastructure | Runs behind Cloudflare's network with DDoS mitigation; monitoring, anomaly detection and regular vulnerability scanning; data replicated and backed up, with recovery tested. | Maxint Security |
| Access control | Production access is role-limited, requires hardware security keys and is logged. Orca uses public keys in clients and private keys on servers; MCP scopes (read, write, destructive) are approved separately by OAuth consent and can be revoked. | Maxint Security; Orca docs |
| Privacy | GDPR and US state-law rights, SCCs for international transfers, a Data Processing Addendum for business customers and a published sub-processor list. Customer data is not used to train public AI models. | Maxint Privacy Policy; DPA |
| Data handling | Transaction data retained while the account is active to preserve entitlements such as lifetime purchases. Export at any time while active and for 30 days after closure; then deleted or de-identified. | Maxint Terms §6, §11; Privacy Policy §6 |
| Vulnerability disclosure | Report to security@maxint.com with reproduction steps. Good-faith researchers will not face legal action; reports are acknowledged promptly and may be credited. | Maxint Security · Reporting a vulnerability |
| Incident response | Documented incident response process with notification of affected users and authorities as required by law. | Maxint Security |
| Support | Community support on Launch; priority support on Growth; dedicated account manager on Scale. | Pricing |
| Data import and export | Bulk import on the way in. Dashboard export and raw data streams on the way out. Store subscriptions remain with Apple and Google; Stripe and GoCardless data remains in your own accounts. | Migration guide; Maxint Terms §6 |
02 · WHEN SOMETHING GOES WRONG
What actually happens.
ORCA IS UNREACHABLE
Subscriptions are safe; your cache keeps serving
The store still holds the subscription and will still renew it. Your server's last known entitlement state keeps working. Native purchases complete in the store and are reconciled when the store notifies Orca; web and desktop checkouts resume when service returns.
Design for it: cache the last known entitlement per customer, decide a fail-open or fail-closed policy per feature, and alert on webhook silence.
A WEBHOOK IS MISSED
Reconcile with a live read
Make your endpoint idempotent, return 200 only after you have persisted the change, and run a periodic getActiveEntitlements sweep for customers with recent activity.
YOU DECIDE TO LEAVE
Export, do not re-acquire
Export from the dashboard. Apple and Google subscriptions can be read by your next provider from the same store credentials; Stripe and GoCardless subscriptions continue in your own accounts. See the migration guide.
03 · READ IT YOURSELF