Privacy Policy
Zero payload retention, zero AI model training, and an uncompromising commitment to never sell or monetize your data.
1. Absolute Guarantee: We Never Sell Your Data
Oridio has never sold, rented, leased, licensed, or monetized personal information, account credentials, or proxy telemetry to data brokers, ad networks, search engines, or third parties, and will never do so under any circumstance.
Our business model is 100% software-as-a-service subscription fees for security and governance infrastructure. You are our customer, not the product.
2. What Information We Collect
We practice strict data minimization. We only collect the minimal subset of data strictly necessary to authenticate your workspace, route traffic, generate billing invoices, and enforce security policies.
A. Workspace & Account Data
- Account Emails: Work email address provided during sign-up for account authentication, password recovery, and invoice delivery.
- Organization Details: Workspace name, tenant UUID, and team member roles.
- Payment Identifiers: Secure payment tokens, card brand, and last 4 digits (tokenized securely via PCI-DSS Level 1 compliant processors; raw card numbers never touch Oridio servers).
B. Proxy Request Telemetry (Metadata Only)
- Quantitative Metrics: Total input/output token counts, execution latency (ms), HTTP response codes, and timestamps.
- Model Identifiers: Upstream provider target (e.g.
claude-3-5-sonnet,gpt-4o). - Policy Verdicts: Cryptographic decision flags (e.g.,
ALLOW,BLOCK, orREDACT) to display analytics in your console. - IP Addresses: Ephemeral source IP retained transiently for rate-limiting and DDoS defense.
3. Ephemeral In-Memory Execution & Zero Payload Retention
Unlike conventional observability or logging services, Oridio is engineered as an ephemeral security proxy:
Prompt payload inspection, PII token redaction, and semantic tool checking occur entirely in volatile RAM within sandboxed WebAssembly runtimes. Latency overhead is strictly bounded (0.7ms p50).
Raw prompt text, agent tool inputs, and model completion bodies are flushed immediately upon forwarding socket responses. They are never written to disks, cold databases, or analytical data lakes.
Tenants requiring cryptographic payload audit archives can configure their own S3 bucket with customer-managed AWS KMS keys; Oridio never holds unencrypted copies.
4. No AI Model Training Guarantee
Customer data is strictly segregated from machine learning operations:
- Zero Foundation Model Training: We never use your agent prompts, context windows, completions, or tool execution arguments to train, pre-train, or fine-tune public or private LLMs.
- Zero Internal Evaluation Distillation: Customer telemetry is never used to benchmark, evaluate, or optimize models outside of your organization's isolated tenant boundary.
- No Third-Party Sharing: Your payloads are never exposed to external contractors, crowd-sourced data labelers, or third-party AI research teams.
5. Encryption & Cryptographic Security
Security is the foundational design pillar of Oridio:
Upstream AI provider API keys stored in the Auth Vault are sealed with authenticated AES-256-GCM envelope encryption and hardware-bound root keys.
All communication between your agents, the Data Plane Proxy, and upstream LLM APIs is enforced over TLS 1.3 with forward secrecy.
6. Your Privacy Rights (GDPR & CCPA / CPRA)
Regardless of your geographic location, Oridio extends enterprise data sovereignty rights to all users:
- Right of Erasure ("Right to be Forgotten"): You may request complete deletion of your account, organization records, and associated metadata counters at any time.
- Right of Access & Export: You can export all workspace configuration, policy definitions, and aggregate billing telemetry via our self-serve APIs.
- Right to Non-Discrimination: We do not discriminate against any user or organization exercising their statutory privacy rights.
Have Questions or Need a Custom DPA?
Contact our Data Protection Officer (DPO) and privacy compliance team.