How ORCA Protects Your Data
A system handling privileged legal materials must meet a high bar. Here's how we do it.
Data Residency in Israel
Application data - case files, exhibits, generated documents - is stored on servers in Israel. AI processing is performed via secure cloud services from international providers (OpenAI, Anthropic). All traffic is encrypted in transit.
Encryption at Every Stage
In transit: all traffic between your browser and our system is encrypted with TLS 1.3. At rest: application data is stored on Azure managed disks, which are encrypted at rest by the cloud platform (platform-managed keys). ORCA does not currently add its own application-level encryption on top of the platform's.
Automatic Deletion
Uploaded files and generated documents are deleted automatically on a defined retention schedule. Documents are removed within 30 days. No request needed.
Your Data Is Never Used for Training
Client materials are never used for model training. Your data belongs to your client. Period.
Access Control
JWT authentication with token refresh. Firm-level isolation - each firm sees only its own documents. Rate limiting on every endpoint.
Upload Security
Every uploaded file undergoes magic-byte verification - checking that file content matches the declared type. Failed files are deleted immediately.
Input Sanitization
XSS protection on all input fields. Security headers (CSP, X-Frame-Options, X-Content-Type-Options). Payload size limited to 1MB.
Case Isolation
Every case is processed in complete isolation. No data sharing between cases, between clients, or between firms. Results are fully isolated.
Continuous Improvement
Security is built into our development process: code review before changes ship, automated dependency scanning, and fail-closed production checks that stop the server from starting if a required security setting is missing. If your organization has specific compliance requirements, let's talk.
Questions about security? Talk to us