Our controls are maintained through automated evidence collection wired into delivery pipelines — the same approach we implement for clients. Everything below can be substantiated on request.
Nothing on this list is aspirational. Where a framework applies to how we work rather than a certificate we hold, it says so.
Access control
Identity-based access with short-lived credentials, hardware-backed MFA for all staff, and no standing production access. Elevation is time-boxed and logged.
Data handling
Client data stays in the client's environment wherever the work allows. Where it cannot, it is encrypted at rest and in transit, region-pinned, and covered by a signed processing agreement.
Secure development
Dependency scanning, static analysis and secret detection run on every merge. Findings above an agreed severity block the build rather than opening a ticket.
Incident response
A documented, rehearsed process with defined notification timelines. Game days are run quarterly against injected failures, not tabletop scenarios.
Business continuity
Recovery objectives are tested rather than assumed. Restore drills happen on a schedule and the results are shared with clients on request.
Personnel
Background checks appropriate to jurisdiction, security training on joining and annually, and access revocation completed within the hour on departure.
The technologies behind the work published on this site. We hold no vendor partner tier and do not claim one — and we stay willing to recommend against any of these when it is the wrong tool.
Write to hello@orbitwren.com and we will send these under NDA, usually within two working days.
- Security practices summary
- Subprocessor list and data flow diagrams
- Standard data processing agreement
- Business continuity and disaster recovery plan
- Insurance certificates (professional indemnity, cyber)
Send us the questionnaire. We complete security reviews as a matter of routine and would rather do it early than at contract stage.