Controls are enforced where visitors, knowledge, and workspaces meet
OrhanAI is designed around tenant scoped retrieval, private server configuration, deliberate widget publishing, bounded visitor context, and separate workspace and super admin access.
- Workspace membership gates private routes.
- Retrieval filters by workspace and AI Agent.
- Widget APIs validate status and domain access.
- Conversation history stays bounded.
Application access
- Workspace users sign in through the user auth flow with HTTP only signed cookies.
- Email verification is required before dashboard access.
- Every workspace user can turn on an authenticator app for two factor sign in, with recovery codes for a lost device.
- Session version invalidation can end prior sessions after sensitive account changes.
- On the Business plan, a workspace can sign its team in through its own identity provider with SAML single sign on, once each email domain is proved with a DNS record.
- OrhanAI staff sign in separately from customers, with their own accounts, permissions and an optional authenticator app.
Connected integrations
- OAuth callbacks validate signed state tokens before saving connected account credentials.
- Google Calendar OAuth access and refresh tokens are encrypted before storage.
- Google Calendar availability checks use bounded time windows, and event creation runs only after a visitor submits an appointment through an enabled AI Agent flow.
- Connected service data remains scoped to the owning workspace, AI Agent, and configured integration.
Tenant isolation
- Only members of a workspace can open its dashboard.
- Every read of your data is limited to your workspace, and to one AI Agent where the data belongs to one.
- Knowledge, conversations, contacts, leads, support records, notifications and usage stay attached to the workspace or person they belong to.
- Automated tests check against a real database that one workspace cannot read another's records.
Widget safeguards
- The widget runs in its own frame, so it cannot read your website's pages and your website's styles cannot change it.
- The widget answers only on the domains you allow, only while the AI Agent is published, and only within rate limits.
- API keys, internal prompts, and server only settings are not exposed to the browser.
- A visitor can pick up a recent conversation, and each answer reads only a short window of it.
Answer generation and files
- Answer generation configuration stays private and server side.
- An AI Agent answers only from the knowledge of its own workspace and AI Agent.
- Attempts to make an AI Agent reveal its instructions are blocked and logged as security events.
- Uploaded files are kept in private storage and reach a browser only after a check on who is asking.
- Deleting a source or a workspace deletes its files and everything learned from them.
How the service is run
- Every page and API is served over HTTPS.
- Access tokens for connected channels and calendars are encrypted before they are stored.
- Webhooks we send are signed, so your server can prove they came from us, and are never sent to private network addresses.
- Visitor IP addresses are never stored as they arrive; rate limits and audit records keep only a keyed hash.
The rest of the trust pack
The documents a buyer's legal team asks for, published rather than held back for a call.
Sub-processorsEvery third party customer data can reach, and what reaches it. Separated into what every workspace uses and what only a connected integration uses.Data processing addendumRoles, scope, security, deletion and audit. Published in full, and signed on request.Incident responseHow an incident is found, contained, communicated and closed, and what will not be done.System statusLive dependency checks, including whether scheduled background jobs have run when they should have.
