Security summary
Ordence security, on one page.
The facts from our security page, on one sheet for a procurement file or a vendor review: what is in place today, and what is not.
In place today
| Area | What is in place |
|---|---|
| One company per system | Each business gets its own system, one company per deployment. No other company's data sits in your database. |
| Your name and address | Your system runs at a web address of your own, verified before anyone can sign in at it, with your name, logo and colours. The phone app installs from that address; there is no app store. |
| Sign-in | Passkeys, authenticator two-factor with backup codes, and SAML single sign-on. A breached-password check, and a lockout after repeated failed sign-ins. |
| Roles and permissions | Eight roles, 118 permissions, per-person overrides, and visibility that follows the manager hierarchy. Document Q&A answers only from records that user may open; agents only suggest, and nothing is sent, priced or edited without a person. |
| Audit | The audit log records changes, exports, and approvals such as a below-margin quotation or a credit-limit override. Vouchers have their own edit log, which cannot itself be edited. |
| Encryption | Personal data encrypted at rest: bank account details, PAN and passport numbers, with AES-256-GCM. HTTPS enforced with HSTS. |
| Backups | Nightly encrypted backups, off the server, with a weekly automated restore test. |
| Connections | Signed webhooks, so the receiver can check a message is genuine. Hashed, expiring API tokens. |
| Export on exit | Any register exports as CSV, Excel or JSON whenever you want it, and if you leave, or Ordence stops, you get a full export of your records. |
| Support | A fault you report in your system is fixed or worked around within 24 hours. There is no public status page yet. |
What it is not
- Not certified. It holds no security certification today: no SOC 2, no ISO 27001.
- The audit log is a record of activity. We do not claim it is proof against alteration by someone with server access.
- A customer system's hosting region and sub-processors are not published on the website. They are set out in each customer's agreement, and provided to invited businesses during the data assessment.
- No version for your own servers. Each business gets its own hosted system.
Data, the law and breaches
- This website's data is kept as a row in a private Google Sheet and as email in our Google Workspace mailbox; nothing from this website is stored in India today. It passes through Cloudflare and our server (the spam check on the forms is a small calculation done in your own browser and checked by our server, with no other company involved), hosted by Railway in its Singapore region (Resend, on Amazon Web Services, is the back-up mail route). The row is deleted automatically once it is twelve months old, and the email twelve months after the last time we heard from you, and the record does not hold your IP address. Server log lines hold no name, email address, phone number or message and are kept by Railway for a limited period.
- A customer's system is a separate deployment with its own database, which this website never speaks to. Its hosting and sub-processors are set out in that customer's agreement and data processing terms.
- The DPDP Act. The DPDP Rules, 2025 were notified on 13 November 2025; the core obligations apply from May 2027. Until then we work to section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011.
- If there is a breach, customers hear from us within 48 hours of us confirming an incident. The Data Protection Board report within 72 hours, under rule 7(2) of the DPDP Rules, is the statutory duty as it comes into force in May 2027.
- Reporting a vulnerability: write to hi@ordence.com with enough detail to reproduce it. No threats or lawyers over a good-faith report, credit if you want it, and no bounty programme. Also at ordence.com/.well-known/security.txt (RFC 9116).
ordence.com/security/summary/ A summary of ordence.com/security/, where each point has its detail. Security questionnaires are answered in writing: hi@ordence.com.
Doing vendor due diligence?
Send the questionnaire your procurement team uses. We answer every question in writing, including the ones where the answer is no.
Questions first? Email the founders.