Trust and security
Your pipeline is the most sensitive data your company has. Here’s how we look after it, in plain English.
Every workspace is sealed off
Row-level security in the database checks every read and write against your workspace membership, so one company can never see another’s data, even through a bug in the app. Automated tests check that isolation on every release.
Encrypted in transit and at rest
Everything travels over TLS. The database is encrypted on disk. Connected mailboxes use OAuth: Orderbook never sees a password.
Single sign-on and roles
Sign in with Google or Microsoft, and admins can require it for everyone, so access follows your company accounts. Admins, managers and reps each see and do only what their role allows; reps can be limited to their own records, enforced in the database.
An audit log
Sign-ins, exports, deletions, role changes, security and sending settings, API keys and CRM connections are recorded with who and when. Admins can search it and download it.
Email that respects people
Only conversations with people already in your CRM are synced and saved. If someone turns on the whole-inbox view, the rest of their mailbox is shown to them live and never stored by Orderbook. Every first email can carry an unsubscribe link and the one-click header Gmail and Yahoo require, and a workspace-wide do-not-email list is enforced on every send.
Your data doesn’t train AI
AI features use business API terms, under which providers don’t train models on your data. Only the records an action needs are sent. Workspaces can bring their own AI key, or turn AI off entirely.
Your data is yours
Export people, companies and deals as spreadsheets, or the whole workspace as one file, at any time, including after a trial ends. Admins decide who may export. Deleting a workspace removes it for good.
Report a vulnerability
Found something? Email hello@getorderbook.app. We reply within two working days and won’t take action against good-faith research.
Compliance
- GDPR and UK GDPR. You are the controller for the people in your CRM; Orderbook processes that data on your behalf, under our data processing agreement, which includes the EU Standard Contractual Clauses and the UK Addendum for any transfer outside the UK and EU.
- SOC 2. Orderbook itself isn’t SOC 2 certified yet. It runs on providers that are (listed below), and we’ll share our security questionnaire answers on request.
- Data subject requests. Admins can export or erase a person’s data from Settings, and an unsubscribe is honoured across every play and send path straight away.
- Breaches. If personal data you trust us with is ever affected, we tell you without undue delay, and within 48 hours of becoming aware.
Sub-processors
The services Orderbook relies on, what each one handles, and their own certifications. We give customers 30 days’ notice before adding one.
| Service | Used for | Data involved | Certified |
|---|---|---|---|
| Supabase | Database, file storage and sign-in | All workspace data | SOC 2 Type 2 |
| Vercel | Hosting the app (London region) | Requests passing through | SOC 2 Type 2, ISO 27001 |
| Stripe | Payments and invoices | Billing contact and payment details (Orderbook never sees card numbers) | PCI DSS Level 1 |
| Anthropic | Default AI provider | Only the records an AI action is asked about | SOC 2 Type 2 |
| OpenAI / Google | AI, only if a workspace chooses them instead | Only the records an AI action is asked about | SOC 2 Type 2 |
| Google / Microsoft | Mailbox, calendar and sign-in, when you connect them | Emails with your CRM contacts, calendar events | ISO 27001 |
| Twilio | Calling from the browser, when a workspace connects it | Call audio while the call happens; recordings until Orderbook copies them, then deleted | SOC 2 Type 2, ISO 27001 |
| Deepgram | Call transcripts, when a workspace sets it up | Recordings of calls reps choose to record | SOC 2 Type 2 |
| Resend | Invitation and notification emails | Name and email of the people emailed | SOC 2 Type 2 |
Need more for your review?
Download the data processing agreement, or ask us for a security questionnaire, a call with whoever builds Orderbook, or anything else your procurement team needs.