Security and privacy

Short version: encrypted everywhere, two-factor sign-in available, no card numbers stored by Orbit.

• Encryption: TLS 1.2+ in transit, AES-256 at rest. Daily backups kept 30 days.
• Card data: handled by Stripe; Orbit never sees or stores full card numbers.
• Two-factor authentication: turn it on under your profile → Security (authenticator app or SMS). Owners can require it for the whole team (Business).
• Sessions: last 14 days; 1 hour on devices marked “shared computer”. Error E-AUTH-010 means a session expired.
• Staff access: Staff only see their own bookings and the customers they serve.
• Privacy: customer data is yours; we don't sell or share it. Delete a customer and their data is removed within 30 days. GDPR data-processing agreement available on request.
• Support access: support can only view your account after you grant temporary access from Settings → General → Support access (valid 72 hours).