Security & data handling

Last updated June 2026

Orbeva touches your financial data, so the security posture is part of the product, not an afterthought. This page describes what we do today. It is written to be specific enough to bring to a procurement or legal review.

Read-only by design

Account connections are established through Plaid and are read-only. Orbeva can see balances, transactions, and holdings to produce your insights — it cannot move money, initiate payments, or place trades. We never see or store your banking password; Plaid brokers the connection and we hold only a revocable, read-scoped token.

Per-client isolation

Each client's data lives in its own logically isolated workspace, scoped by a tenant identifier and enforced at the database layer (row-level security) in addition to application checks. Your data is never pooled with another client's and is never visible across tenants.

We never train on your data

Your financial data is processed to generate your insights and nothing else. It is never sold and never used to train AI models — ours or a provider's. Where a model provider is used, we route through configurations that disable provider-side training and request zero data retention.

Encryption

Data is encrypted in transit (TLS) and at rest. Per-client secrets, such as connection tokens, are stored encrypted and are only ever decrypted within the boundary that needs them, scoped to your tenant.

Retention & deletion

You can export or delete your data at any time. On termination, your data and connection tokens are deleted, and a deletion receipt is available on request. Specific retention windows for prompts, uploads, and derived analytics are listed in our Data Processing Addendum, available to clients.

Subprocessors

We use a small, named set of infrastructure and model providers. See the live subprocessors list, which is generated from the systems we actually call so it cannot drift from reality. We provide notice before adding a new subprocessor.

Compliance roadmap

A signable DPA is available to clients. SOC 2 Type II is in progress; we are happy to share our current posture and timeline under NDA.

Found something, or have a security question? Email security@orbeva.ai.