Trust

Our security posture, stated plainly.

The same standard we apply to product claims applies here: what follows is what is engineered and testable in the codebases today — not what a future audit might say.

Data protection

  • AES-256-GCM field-level encryption for sensitive data at rest; TLS in transit.
  • Argon2id password and API-key hashing across products.
  • PostgreSQL row-level security enforced at the database, not the application layer.
  • Multi-factor authentication (TOTP) and enterprise SSO (SAML / OIDC / WorkOS) on enterprise products.

Auditability

  • Append-only SHA-256 WORM audit chains with Merkle batch roots under regulated workflows.
  • Database triggers block UPDATE and DELETE on audit tables — tamper is structurally visible.
  • ZeroMythic events carry Ed25519 signatures and Merkle inclusion proofs verifiable offline, without trusting us.
  • Seven-year retention on sealed decision envelopes where regulation expects it.

Compliance engineering

  • ORDR Connect engineers SOC 2 Type II, ISO 27001:2022 (all 93 Annex A controls) and HIPAA as enforced rules and CI gates.
  • ORDR Treasury covers EMIR, MiFID II and Dodd-Frank submissions with IFRS 9 / ASC 815 effectiveness testing.
  • ORDR Aegis implements ISDA SIMM v2.6, Basel FRTB and regulatory stress frameworks (CCAR / EBA / NGFS).
  • GOLDX applies tiered KYC with sanctions and FATF grey-list screening.

Responsible AI

  • AI assistants are advisory: they cannot write to audit tables or sit in calculation loops.
  • Agentic systems run under tool allowlists, token/cost/action budgets and kill switches.
  • Low-confidence agent actions route to human review.
  • Prompt-injection guards and PII scrubbing on user-facing analysis surfaces.

Honest disclosure

Certifications such as SOC 2 and ISO 27001 are stated as engineered-for targets: the controls are implemented and enforced in code and CI, and formal third-party certification is pursued per product as each reaches the appropriate stage. Products marked preview or pilot are not production systems and are labeled accordingly throughout this site. Questions about our posture: hello@ordrholdings.com.