Security
Your own system, locked down.
One company per system, at your own web address and under your name. Passkeys, permissions down to the person, encrypted personal data, and a backup restore tested every week. It holds no security certification today, and this page says what that means.
At a glance
What is in place today. Each row links to detail. For a procurement file: Download a one-page security summary.
| Area | What is in place |
|---|---|
| Data region | Website data: Railway, Singapore. None stored in India today. A customer's system: per their agreement. Details: data region |
| Encryption | Bank details, PAN and passport numbers encrypted (AES-256-GCM). HTTPS enforced. Details: encryption |
| Backups and the restore test | Nightly, encrypted, off the server. Restore tested weekly. Details: backups and the restore test |
| Sign-in | Passkeys, two-step sign-in, company sign-in (SAML), leaked-password check, lockout. Details: sign-in |
| Roles and permissions | 8 roles, 118 permissions, per-person changes. Details: roles and permissions |
| Certification | None today: no SOC 2, no ISO 27001. Details: certification |
| Export on exit | Any register, any time. A full export if you leave or Ordence stops. Details: export on exit |
One company per system
No other company's data sits in your database.
Each business gets its own system, set up for its trade. Your buyers, rates, margins and books sit in a system that holds only your business.
Your records stay yours. Export any register whenever you like. If you leave, or Ordence stops, you get a full export. What happens if you leave.
Your name, your address, your app
Your staff and customers see your company, not ours.
- Your own web address. Such as crm.yourcompany.com, or another address you own. It is verified before anyone can sign in there.
- Your name, logo and colours. On every screen, and your logo on printed invoices.
- Your app on their phones. It installs from that address, with your name and icon. No app store.
When a customer opens their statement: the address, name and logo they see are yours.
Signing in
- Passkeys. Fingerprint, face or PIN, with no password to steal.
- Two-step sign-in with an authenticator app, and backup codes for a lost phone.
- Company sign-in (SAML) through your company's login provider.
- Leaked-password check, and a lockout after repeated failed sign-ins.
Who sees what
Eight roles and 118 permissions, adjustable per person. Managers see their team's records.
- The AI keeps to the same lines. Document Q&A answers only from records that person may open.
- Agents only suggest. Nothing is sent, priced or changed without a person.
A record of who did what
The audit log records changes, exports, and approvals such as a below-margin quote or a credit-limit override. Accounting entries have their own edit log, which cannot itself be edited.
Encryption and backups
- Personal data encrypted when stored. Bank account details, PAN and passport numbers, with AES-256-GCM.
- Nightly encrypted backups, off the server, with an automatic restore test every week.
- HTTPS enforced with HSTS, so browsers always use a secure connection.
Connections from outside
- Signed webhooks, so the receiver can check a message is genuine.
- Access tokens stored scrambled (hashed), and they expire.
The full list is on the integrations page.
Where your data lives and who processes it
Two sets of data, two answers.
What you send through this website (an enquiry, an invitation request, or a calculator summary sent by email) is kept as a row in a private Google Sheet owned by our Google Workspace account, with an email copy sent from and kept in our Google Workspace mailbox. On the way it passes through Cloudflare and our server, hosted by Railway in its Singapore region; Resend is the back-up mail route. Nothing from this website is stored in India today.
The sheet row is deleted automatically once it is twelve months old, and the email copy twelve months after the last time we heard from you. The record does not hold your IP address. Anonymous page events and browser security reports are not stored in a file; they are short-lived lines in the server log, kept by Railway for a limited period. Each form submission also leaves a short line there. No name, email address, phone number or message is written to any of these lines.
The spam check on the forms is a small calculation your own browser does, set and checked by our server. Nothing about it is sent to any other company, and there is nothing to click.
| Who | What they do | Where |
|---|---|---|
| Railway | Hosts this website and its forms, and keeps the server's short-lived log lines (no names, email addresses, phone numbers or messages). | Singapore (Railway's Singapore region) |
| Cloudflare | Domain, DNS, and the network in front of the website. Every request, including a form you send, passes through it. | Global edge network |
| Google (Google Workspace) | Our mailbox, which sends the notification and acknowledgement emails (through Google Apps Script) and keeps them; a private Google Sheet of enquiries, invitation requests and welcome-link details; Google Drive for the brochure. | Google's data centres, which may be outside India |
| Resend | Back-up email delivery, used only if sending through Google fails. | Outside India, on Amazon Web Services infrastructure |
A customer's Ordence system is separate, with its own database. This website never talks to it. Where it is hosted, and which outside services touch it (sub-processors), are set out in that customer's agreement and data processing terms, so they stay accurate contract by contract.
The privacy policy has the full detail for both. The data processing page covers a customer's system.
The DPDP Act, and where we stand
India's Digital Personal Data Protection Act, 2023 is law. The DPDP Rules, 2025 were notified on 13 November 2025 and start in steps. The main duties (notices, security safeguards, breach reporting, retention and erasure, and people's rights over their data) apply from May 2027, eighteen months after the Rules were published.
Until then, the rules in force are section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011. Those are what we work to today. Much of the privacy policy is ahead of the May 2027 deadline. Where a line there is a promise rather than something already in place, it says so.
If there is a breach, customers hear from us within 48 hours of us confirming it. Reporting to the Data Protection Board within 72 hours, under rule 7(2) of the DPDP Rules, becomes a legal duty in May 2027. The data processing page sets out who tells whom.
What it is not
- Not certified. No security certification today: no SOC 2, no ISO 27001.
- The audit log is a record of activity. We do not claim someone with server access could not alter it.
- A customer system's hosting region and sub-processors are not published here. They are in each customer's agreement, and shared with invited businesses during the data assessment. The website's own are listed above.
- No version for your own servers. Each business gets its own hosted system.
Reporting a vulnerability
Write to hi@ordence.com with enough detail to repeat it. We will not threaten you or bring in lawyers over a good-faith report, and we credit you if you want. There is no bounty programme.
The same contact is at /.well-known/security.txt (RFC 9116).
Support and service status
A fault you report in your system is fixed or worked around within 24 hours. Report it to hi@ordence.com or the support route in your agreement.
There is no public status page yet. If something looks down, write to the same address. When a status page exists, it will be linked here.
Questions
Can Ordence run under our own name and web address?
Yes. Your system runs at your own address, such as crm.yourcompany.com, with your name, logo and colours on every screen. The phone app installs from that address with your name and icon, no app store.
Is our data in the same database as other companies?
No. Each business gets its own system. No other business's data is in your database.
Where is the system hosted, and who are the sub-processors?
For a customer's system, it is in the customer's agreement, and shared with invited businesses during the data assessment. For this website, the list is above: Railway in Singapore, Cloudflare, Google Workspace, and Resend on Amazon Web Services as a back-up.
Are you SOC 2 or ISO 27001 certified?
No. It holds no security certification today. The controls it does have, from passkeys to weekly restore tests, are listed above, and we answer a security questionnaire in writing.
Doing vendor due diligence?
Send the questionnaire your procurement team uses. We answer every question in writing, including the ones where the answer is no.
Questions first? Email the founders.