ORBITRA / SECURITY

Clarity before action.

What Orbitra can access, who decides what it does, and how to reach us about security.

What access Orbitra needs

Orbitra connects to Microsoft Entra ID and Azure as an application that your administrators approve. It starts with read-only access, so it can investigate without changing anything. Permissions that can change your environment are separate and narrowly scoped. They’re added only when your team chooses to add them.

Before you connect, we’ll walk your team through each permission, why it’s needed and how to remove it. To disconnect, remove Orbitra’s connection and revoke its application consent in your tenant. Access that was already granted can stay valid for a short time, depending on your provider’s settings.

To review the permissions for your environment, book a walkthrough (opens in a new tab).

Does read-only access let Orbitra respond to a threat?

No. Reading identity information and changing it are separate permissions. A response needs both the permission to make the change and an approval to make it.

People keep authority

Your policy decides which actions can run automatically, within limits you’ve approved in advance. Anything outside those limits, or without enough evidence, goes to a person to decide. Each action records who or what authorized it. After a change, Orbitra checks that it actually took effect.

Can an AI recommendation authorize itself?

No. A recommendation can’t authorize itself. Authority comes from a defined policy and, where required, an authorized human decision, never from a model’s answer.

Your data

The website and the Orbitra platform are separate systems. Where customer data is processed depends on your deployment, and your agreement sets it out.

How data is used

Assurance

We don’t claim any security certification today. During your evaluation, ask us for the security information your review needs.

Report a security issue

Email security@orbitrasecurity.com. We acknowledge reports within five business days.

Read the vulnerability disclosure policy

Help us improve this site