Security and Data

This page is for people who need to approve Orgonaut before loading real organisation data, for example security reviewers, data protection leads, and consultants working with client data. It describes how the product behaves today.

Where your data is hosted

• Orgonaut, its database, and its file storage run on Railway in Railway's Amsterdam data centre in the Netherlands (EU). Railway runs this on its own hardware (Railway Metal), not a public cloud provider.
• Uploaded files, such as import files, exports, and branding images, are kept in that same region.
• All traffic to Orgonaut uses HTTPS.

How organisations are kept apart

• Each saved organisation is a separate tenant, and account queries are filtered to your selected tenant. Temporary guest drafts are separate capability-owned records with no access to account data.
• Links, API tokens, MCP connections, and CLI sessions all work inside one organisation only.
• Credentials for connected systems, such as HRIS API keys, are encrypted in the database.

Who can see what

• Roles: each member has a role (Owner, Admin, Manager, Member, or Viewer). The role controls what they can read and change. See Users & Access.
• Cost and pay data needs the costs.read permission. Velocity needs org-metrics.read.
• API, MCP, and CLI tokens: each token has its own scopes, and can only do what both its scopes and its owner's role allow. A token created without costs.read never receives salaries, day rates, budgets, or cost totals from the REST API, MCP tools, or the CLI, even when its owner could see them. Those fields are removed from responses, and pay-record endpoints refuse the request.
• Sign-in: you can sign in with a password or with Microsoft, Google, GitHub, or OpenAI. SAML single sign-on is available on eligible plans.
• Activity log: changes to people, teams, placements, pay, scenarios, settings, and access are recorded in the organisation's activity log at /settings/activity.
• Read-only history: archived scenarios and snapshots can't be edited.

How AI features use your data

Astro, Orgonaut's in-app assistant, uses OpenAI models.

• No training on your data. OpenAI is not permitted to train its models on data from Orgonaut.
• Not stored by OpenAI for reuse. Orgonaut sends every Astro request with OpenAI's response storage turned off, so OpenAI does not keep answers for later retrieval. Under OpenAI's API terms, it may still hold request data for a limited period for abuse monitoring.
• What is sent to the model:
  • your question
  • up to the last 20 turns of the current chat, plus a short summary of earlier turns
  • any memories you have saved
  • the results of the lookups Astro runs to answer you
• Lookups follow your permissions. Astro sees only what you can see. For example, if you don't have costs.read, cost fields are removed before anything reaches the model.
• Documentation search: Orgonaut's public product documentation is indexed with OpenAI embeddings. Your search question is sent to find matching passages. Your organisation's records are not indexed.
• Proposals don't change anything on their own. Astro can draft scenario changes, but nothing is written until you confirm.
• Agents you connect (MCP and CLI): these use your own AI tool, such as Claude or ChatGPT. Orgonaut sends that tool only what the token's scopes allow. That provider's terms then apply to the data it receives.
• Claude Code usage sync: if you connect it, Orgonaut reads usage reports from your Anthropic account. No Orgonaut data is sent to Anthropic.

Other services we use

Connected HR systems, such as BambooHR and Microsoft Dynamics 365, are read from. Orgonaut doesn't write back to them.

How long data is kept

Temporary plugin guest models

• Guest baseline and scenario contents are encrypted in Orgonaut's database. A private opaque capability authorises each draft; account data is never exposed through guest tools. Claim links carry only an opaque token in a URL fragment, which is exchanged into a server-side session and removed from the browser URL.
• Drafts expire after 7 days and unused claim links after 30 minutes by default. Expired drafts are inaccessible immediately; the hourly cleanup removes their records and links. Deployment settings can change these periods. After saving, the guest content is cleared and its capability cannot read permanent records.
• The saved organisation retains its original definitions and scenario sources, with tenant permissions and normal account retention. Owner exports include the lossless definitions under orgspec-definitions/. Import source files use Orgonaut's existing private file storage.
• Guest funnel analytics use an anonymous ID and bounded counts or lifecycle events. They do not contain names, contact details, draft content, raw tokens or claim URLs. Local anonymous event records are retained for 90 days by default; configured analytics provider retention applies separately.
• ChatGPT processes the conversation used to create the model under its own terms. Orgonaut's guest validation and structural analysis do not make a second AI call. Saving introduces no purchasing or payment flow.

While your account is active

• Your organisation data is kept until you change or delete it. This includes people, teams, departments, positions, pay records, scenarios, imports, and Astro chats.
• Activity history is kept for the life of the account.
• Archiving an Astro chat hides it. It doesn't delete it. Where Astro memory is turned on, saved memories can be deleted at any time from your assistant settings.
• Exports: the download is available for 7 days. After that, the file is deleted and you need to request a new export.
• Deleting an import removes its uploaded file and review data.
• Sign-in sessions end after 2 hours of inactivity. Remembered devices are forgotten after 400 days without use.

If you delete your user account

• Deleting your own account from Settings → Profile → Danger zone removes it immediately. It also removes your Astro chats and memories.
• You can't delete your account while you own an organisation. Transfer ownership first.
• Entries in the activity log that record changes you made remain part of the organisation's history.

If a subscription ends or a trial expires

1. Grace period (7 days). When a cancelled subscription reaches the end of its billing period, the organisation has 7 days to export its data.
2. Locked (60 days). After the grace period, or when a trial ends without a subscription, the organisation becomes read-only. You can still sign in and export your data.
3. Closed. 60 days after locking, the organisation is closed and all access stops. It is then queued for permanent deletion.
4. Permanent deletion. The Orgonaut team carries this out. It removes the organisation's records, activity history, Astro chats, and stored files. Before deleting, we keep one export archive in private storage so an accidental deletion can be reversed. The archive is deleted automatically 30 days later. To have it removed sooner, email support@orgonaut.co.

You can reactivate a subscription at any point before permanent deletion to restore full access.

Certifications and agreements

• Certification: Orgonaut doesn't currently hold SOC 2 or ISO 27001 certification. SOC 2 is on our roadmap.
• Data processing agreement: organisations on the Business, Enterprise and Agency plans can download a GDPR data processing agreement from Settings → Data Processing Agreement. It covers what we process and why, security measures, sub-processors, breach notification, international transfers, and deletion. Sign it and email a copy to support@orgonaut.co, and we'll countersign.

Requests and contact

For a full data export, owners and admins can go to Settings → Export. The ZIP includes Live data, active planning scenarios, configuration, activity history, integration connections and sync logs, and initiatives.

For deletion confirmation, a copy of our terms, security questions, or to report a vulnerability, email support@orgonaut.co.

Related docs

• Users & Access
• Billing and Subscriptions
• Astro
• MCP reference