Security is foundational to ORA. As a constitutional AI operating system, ORA handles sensitive agent operations, workflow data, and MCP memory. This policy describes our technical and organizational security measures.

1. Encryption

In transit: All data transmitted between your client and ORA is encrypted using TLS 1.3+. HTTP connections are redirected to HTTPS.
At rest: Stored session data, MCP memory, and logs are encrypted using AES-256.
Model requests: Requests to any cloud model endpoint you configure are encrypted in transit per the provider’s specifications. Local model traffic never leaves your machine.

2. Access Controls

Authentication: Google OAuth 2.0 with mandatory email verification. API keys use secure random generation.
Least privilege: Internal staff access systems only as needed for their role. Production data access is logged.
Session management: Authentication tokens expire after 24 hours of inactivity. Forced re-authentication for sensitive operations.

3. Agent Security

All agent actions are logged with full audit trails
Governance gates prevent unauthorized agent escalation
Tool calls to external systems require explicit configuration
No agent can access systems outside your configured tool list

4. Incident Response

In the event of a security incident affecting personal data, we notify affected users within 72 hours of discovery, consistent with GDPR requirements. Notification includes nature of the incident, data categories affected, and remediation steps. Full incident policy at Incident Disclosure Policy.

5. Vulnerability Disclosure

If you discover a security vulnerability in ORA, please disclose it responsibly to [email protected] with “Security Vulnerability” in the subject line. We will respond within 48 hours and work to address confirmed vulnerabilities promptly. We do not take legal action against good-faith security researchers.

6. Compliance Roadmap

SOC 2 Type II: Planning phase (target 2027)
ISO 27001: Under evaluation
GDPR compliance: Active (adequacy decision for Canada)
NIST AI RMF: Implemented (see Risk Assessment)

7. Contact

Security questions: [email protected] — subject “Security.”

Security Policy