Security
Built for the keys to your servers
Orchec can create, change and delete the machines your business runs on. This page explains how we keep that power narrow, visible and accountable.
Architecture
Nothing on your servers listens for Orchec
Each server runs a small Rust agent that opens one outbound, mutually authenticated connection. Orchec holds no SSH keys for your servers, and there is no inbound port to attack.
Controls
How access is limited
Typed operations only
The agent runs a fixed, allow-listed set of operations with typed arguments. No raw shell strings, from anyone, including the AI.One authorization path
Every API route, job, realtime stream and AI action is checked by the same policy engine. There is no second path.Encrypted secrets
Secrets are envelope-encrypted per organization, masked by default, and every reveal is logged with who and when.Strong sign-in
Two-factor with TOTP and passkeys, session management, and scoped API tokens that expire.AI inside the same rules
AI acts as the person who asked, sees no secret values, and every change it proposes waits for approval.A complete audit trail
Who did what, when, from where, and with what result, for people, bots and AI alike.
Supply chain
What you install is what we built
The agent is open source under Apache-2.0, so anyone can read the code that runs on their servers. Releases are signed, and installs check a published SHA-256 before running.
- Signed releasesAgent binaries and release artefacts are signed, and the agent verifies updates before applying them.
- Checked installsThe install command verifies the script against its published SHA-256 before it runs.
- Pinned dependenciesExact versions, a 14-day minimum age for new releases, licence checks and audits in CI.
- Open agentThe agent and its protocol are Apache-2.0. The control plane is source-available under FSL-1.1 and becomes Apache-2.0 two years after each release.
Disclosure
Found a vulnerability?
Tell us first and give us time to fix it. We reply within two business days, keep you updated, and credit you if you want.
Email security@orchec.com with the steps to reproduce, the impact you expect, and any proof of concept. Our contact details are also published at /.well-known/security.txt.
Please don't access other people's data, degrade the service or run automated scans against production. A paid bug bounty opens with the public launch.
Questions about data protection go to privacy@orchec.com. Read the privacy policy and the data processing agreement.
Bring your security team.
Book a demo and we will walk through the architecture, the threat model and the controls in detail.