Security & trust
Safety belongs
in the workflow.
Orbit is built for agencies responsible for live client sites. Access, site connections, and maintenance actions need clear boundaries and a record people can inspect.
The operating principle
A human owns the decision.
AI can help describe a site or organize a plan. It does not hold a free-form path to production or run a change on its own.
IN PRACTICE
Scoped access
Agency roles and configured permissions determine the sections and operations available to each teammate.
Known actions
Authorized teammates choose supported operations through the application’s site controls.
A visible record
Site records, maintenance tasks, and activity history help teammates understand the work.
Safeguards by design
Boundaries around the site.
Security is easier to reason about when the agency, site, connection, and action each have an explicit scope.- Agency isolation
- Sites, members, preferences, contracts, and integrations belong to the agency workspace. Member roles and configured permissions control access to supported sections and actions.
- Per-site connection
- The WordPress connector authenticates its connection with a site-specific token. Keep connector access and team permissions under agency control.
- AI boundary
- The internal assistant offers contextual, read-only explanations of site data and audit findings. It does not execute maintenance actions.
- Two-factor authentication and credential vault
- Enable two-factor authentication for accounts and store site credentials in the encrypted vault. Revealing a stored secret requires password reconfirmation.
Coming
Safe Update · Coming
Review before production.
Safe Update is coming. The planned workflow would make a change visible through staging and visual checks before it reaches a live client site.
- Plan
Choose an update
The planned workflow would start from the site record and selected update candidates.
- Check
Look in staging
Apply the proposed change away from production and capture evidence of the result.
- Approve
Make the call
A person reviews the change, visual difference, and risk before a production step.
- Record
Keep the history
Attach the action, approval, outcome, and time to the site and task record.