Security & data
Plain answers about what Orbis stores, who processes your messages and what its agents are allowed to do. This page describes how the product works today.
Accounts and sign-in
- Accounts are managed by Supabase Auth. Passwords are never stored by Orbis itself; Supabase stores only a secure hash.
- Google sign-in, when enabled, uses Google's own sign-in page — Orbis never sees your Google password.
- The site is served over HTTPS only, with security headers that stop it being framed by other sites.
What Orbis stores
- Your conversations, custom agents, missions, Council and Arena sessions and projects, so you can come back to them.
- A usage record for each AI request: the model, token counts, estimated cost and the first part of the prompt and reply (up to 4,000 and 8,000 characters). These records enforce your plan limits.
- Everything is stored in a Postgres database with row-level security: signed-in users can read only their own data. The people who operate this site can access the database for maintenance.
Where your messages go
- To answer you, your message and the conversation so far are sent to the provider of the model that replies: Anthropic for Claude, OpenAI for GPT, Google for Gemini and xAI for Grok (Gemini and Grok only when the site has them switched on). Their own terms and data policies apply to that processing.
- Every reply names the model that wrote it, so you always know which provider received your message.
- Live web search isn't enabled on this site yet. When it is, search queries will be sent to the search provider.
What agents can and can't do
- Assistants and agents write, explain, plan and review inside Orbis. They don't send emails, make purchases, or change your accounts or systems.
- In Mission Control the AI drafts tasks but can't mark them complete — only you can.
- The Security Team scans a website only after you prove you own it, never follows redirects to other domains, and never reaches private network addresses. It doesn't apply fixes for you.
Code execution
- The general assistant and the Coding Agent never run code.
- The Autonomous Developer (private preview, administrators only) runs a repository's own checks in an isolated cloud sandbox. Network access is cut off after dependencies install, each task has a spending budget, plans need human approval, and nothing is pushed to your repository.
Your control
- Delete any conversation from the sidebar at any time.
- Account deletion isn't self-service yet. Until it is, the site operator can delete an account and its data on request.
- Orbis shows no advertising.
A formal privacy policy and terms of service are being prepared and will be linked from every page once published. See also the Security Team for checking your own site and code.