Security Policy
Draft pending legal review.
How Orren is built
- Your Mac holds the master copy. The app works offline; the server holds a synchronised copy so that Orren can answer questions across all of your records.
- Encryption. Everything between the app and Orren's servers travels over TLS. Data at rest on Google Cloud is encrypted by Google.
- Isolation between customers. Every customer's rows in the database are separated by row-level security that is enforced for every database role, including administrative ones. A query for one customer cannot return another's rows.
- Tokens. Platform tokens held on the server are never returned to the app or shown in any interface; the app receives only whether a connection is live. Tokens the app holds itself live in the macOS Keychain.
- What leaves your Mac is declared. The release build runs a census of every network path in the app and refuses to build if one is undeclared or undocumented. Diagnostics carry counters and error codes, never content.
- Signed and notarised. The app is signed with an Apple Developer ID and notarised by Apple. Updates are signed and verified before they install.
- Access. Production access is limited to the people who run Orren, each with their own credentials. Secrets are held in Google Secret Manager, never in source.
- Testing. Every deploy runs a suite that checks the service does not leak tokens, model names, other customers' data or internal detail in any response, including error responses.
Reporting a vulnerability
If you believe you have found a security problem in Orren, please tell us before telling anyone else.
- Email josh@conquermental.com with "security" in the subject. We acknowledge within two business days and keep you informed.
- Please give us enough to reproduce it, and please do not access, change or delete data that is not yours, do not disrupt the service, and do not test against other customers' accounts. Test with your own.
- We will not take legal action against research that follows these rules and is made in good faith.
- We fix confirmed issues as quickly as their severity warrants and credit you if you wish once the fix has shipped.
A machine-readable version of this notice is at /.well-known/security.txt.
Incidents
If we learn of a breach affecting your data we tell you without undue delay and within 72 hours of becoming aware, with what we know, what it affects, and what we are doing about it.