Your data stays yours, and the record of what we did to it cannot be edited by anyone.

Orchai runs on Google Cloud. Your account is a tenant with its own isolation boundary, so no other client's agents, queries, or engineers can reach your data by design rather than by policy.

• Encrypted in transit and at rest, with managed keys
• Per client isolation, no shared working data
• Regional data residency where your contract requires it
• Platform certifications inherited from Google Cloud

Access is scoped to a role and a reason, for people and agents alike. An agent holds only the tools its job needs, and a human on our side needs a logged, time bound grant to look at your account at all.

• Least privilege by default, for staff and agents
• Time bound access grants, never standing access
• Single sign on and enforced multi factor for your team
• Every access event logged, including reads

Every action, approval, and blocked attempt is written once to an append only log. There is no edit path and no delete path, not for your strategist, not for our engineers, not for support.

• Append only, write once retention
• Hash chained, so tampering is detectable
• Blocked and denied attempts recorded too
• Retained for the life of the contract, then released to you

• Export any time: The full log and the graph behind it, in a machine readable format, on request and without a fee.
• Read every decision: Not a summary. The actual entries, including the actions a guardrail refused to let through.
• Challenge any entry: Dispute a decision and a named human answers it against the record, not against a recollection.
• Leave with your data: The graph is a record of your business. On exit you take it, and your working data is deleted on a stated schedule.
• Know the subprocessors: A current list of every vendor in the chain, with notice before it changes.