Security at Orlan AI
Orlan handles your lead pipeline and messages on your behalf. Here is how we protect that data.
Data encryption
All traffic to Orlan AI is served over TLS. Data is encrypted in transit and at rest by our infrastructure providers.
Tenant isolation
Every record is scoped to the owning agent. Database-level row security policies enforce that agents can only read and write their own leads, listings, conversations, and messages.
Authentication
Accounts are protected by email/password or Google sign-in. Session tokens are stored in HTTP-only cookies and refreshed server-side. Administrative access requires additional verification.
Payment security
Orlan AI never stores card numbers. All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Billing webhooks are cryptographically signature-verified.
Messaging compliance
Inbound and outbound SMS honor STOP, UNSUBSCRIBE, and HELP keywords automatically. Opt-out events are written to an immutable compliance log, and messaging respects state-level quiet hours.
Provider integrity
Telephony webhooks are signature-validated before processing, and duplicate webhook deliveries are de-duplicated so retries cannot double-send messages or double-charge accounts.
Reporting a vulnerability
If you believe you have found a security issue, email support@orlanai.com with details and steps to reproduce. We investigate every report and will acknowledge receipt.