Security & Data Protection

Orion holds bills, balances, income, business records, and uploaded statements. This page describes the controls that are actually in place today, in plain language and without exposing implementation details that would help an attacker.

We do not claim SOC 2, ISO 27001, PCI DSS, HIPAA, or any other certification. We will say so here if that ever changes.

• Sign-in is handled by a dedicated managed authentication service; passwords are hashed and salted and are never visible to us.
• Email/password and Google sign-in are supported.
• Sessions use short-lived access tokens with refresh, and every server request re-verifies the token before touching data.
• Signing out clears the session and the cached data in your browser.

• Roles are stored in a dedicated roles table, never on your profile, so they cannot be changed by the browser.
• Role checks run on the server. Hiding a button is never the only control.
• There is no impersonation feature — staff cannot log in as you.

Internal dashboards for platform health, backup readiness, business metrics, and conversion analytics are restricted to founder/admin accounts and enforced server-side. They are built on aggregates — counts, totals, scores, and trends — not on customers’ individual financial records, account numbers, or documents.

• Uploaded statements, bills, receipts, and credit reports go into a private bucket with no public URLs.
• Files are readable only by the account that uploaded them, through short-lived signed links.
• Sensitive identifiers such as Social Security numbers and full account numbers are masked in credit workflows before analysis or display.

Every table holding user data enforces Row Level Security at the database layer, scoped to the signed-in user’s ID. Even if an application bug asked for someone else’s row, the database would refuse to return it. Policies are reviewed whenever a table is added or changed.

• All traffic is encrypted in transit with HTTPS/TLS.
• The database and file storage are encrypted at rest by our managed cloud platform.
• Credentials and API keys are held in a managed secret store, never in application code or the browser.

Orion includes an internal Platform Health module that continuously checks database reachability, authentication, storage, AI availability, schema integrity, and access-policy coverage, and records health snapshots over time so regressions are visible quickly. Application errors are captured and reviewed.

• The managed cloud platform performs automated encrypted backups of the database.
• Schema and access-policy snapshots are captured and version-controlled with the application.
• Backup age and readiness are tracked in an internal Backup Center dashboard.

We maintain a written restoration runbook covering schema, access policies, storage buckets, authentication configuration, and the identifiers that must be preserved for restored data to reconnect to the right accounts. Recovery readiness is rehearsed non-destructively rather than assumed.

• Contain first: revoke affected credentials or sessions and stop the exposure.
• Investigate scope using platform logs and integrity checks.
• Notify affected users without undue delay when personal data is involved, and notify authorities where law requires.
• Fix the root cause and record what changed.

Security questions and concerns: security@ultimatebillorganizer.com.

Card details are entered with our payment processor and never touch Orion’s servers or database. We store only subscription status and non-sensitive billing metadata.

• Sessions expire and refresh automatically; expired sessions are redirected to sign-in.
• Protected routes are gated before page data loads, not after render.
• Signing out cancels in-flight requests, clears cached data, and removes the protected page from browser history.

• Use a strong, unique password and secure the email account tied to Orion.
• Sign out on shared devices.
• Upload only documents you are authorized to share.
• Report anything suspicious to security@ultimatebillorganizer.com.

If you believe you have found a vulnerability, email security@ultimatebillorganizer.com with the steps to reproduce it. Please give us a reasonable window to fix it before publishing.

• Do not access, modify, or delete data that is not yours.
• Do not run denial-of-service, spam, or social-engineering tests.
• Use only accounts you own for testing.
• We acknowledge reports and will not pursue action against good-faith research that follows these rules. We do not currently run a paid bug bounty.