Trust CenterSecurity OverviewThis overview describes implemented application controls. It is not a SOC 2 report, penetration-test attestation, availability certification, or promise that an optional provider is connected.
Authenticated APIs apply tenant, role, and relationship checks. Enterprise SSO or SCIM is presented as ready only after a successful, dated provider verification. Administrators remain responsible for least-privilege role assignment.
Configured connector credentials are stored server-side as tenant-bound encrypted ciphertext and returned to browsers only as redacted metadata. Connection labels require server-side validation evidence.
Production builds fail closed unless release enforcement, rollback binding, and verification evidence are present. Post-deploy checks validate both the primary and immutable deployment URL.
The public status contract reports component checks and scheduled-workflow health, including failed, stale, and never-run jobs. Configuration alone is not reported as provider health.
The browser shell precaches versioned startup assets and provides a controlled offline page. Server backups and restore exercises require current production evidence before being represented as verified.
Operational events are tenant-scoped and distinguish internal records from third-party delivery receipts or independent attestations. Retention, legal hold, export, and deletion behavior depends on contract and configured workflow.
Customer-selectable data residency is not currently guaranteed. Provider availability, commercial data licenses, backup restoration, SSO/SCIM, email delivery, payment processing, and external monitoring are verified only when the applicable production configuration and dated evidence exist. OrionOS does not claim an independent security certification on this page.
Security reports: operations@oriontransportation.us. Published contact: security.txt.