Security & Air-Gap VPC

Platform security practices

Orbyt includes password hashing, session-based access controls, permission checks, protection against cross-site request forgery on state-changing requests and prepared database queries. Those controls support the platform's security design; they do not guarantee that a deployment is free of vulnerabilities.

Seller business and tax evidence uses a private review workflow. Sensitive records are not intended for public listings or ordinary team access. Production operation requires appropriate encryption-key management, restricted access, backups and retention procedures.

Private networks and air-gapped deployments

A private cloud or local installation is not automatically air-gapped. Identify every external dependency, including payments, identity services, email, licensing, updates and product integrations. Only a separately evaluated product and configuration should be described as supporting disconnected operation.

Shared operational responsibilities

For self-hosted products, confirm who maintains the server, operating system, database, TLS certificates, access controls, backups and security updates. Limit privileged accounts and test restore and incident-response procedures before relying on the deployment.

Printer and other equipment integrations require additional attention to network boundaries, operator permissions and physical safety. Follow manufacturer guidance and verify product-specific capabilities rather than assuming the marketplace supplies emergency-stop or safety certification functions.

Reporting a concern

Use the Contact page to report a suspected vulnerability and request an appropriate private reporting channel. Do not include passwords, payment-card details or unnecessary personal records in an initial message. Test only systems you own or have explicit permission to assess.

No independent security audit, regulatory certification or compliance designation is claimed by this overview.