Security
Last updated: May 2, 2026
Our commitment
The security of your data is a fundamental priority at ORQENZA. We implement multi-layer security controls to protect your information against unauthorized access, misuse, alteration, or destruction.
Infrastructure
- Dedicated servers in ISO 27001-certified data centers
- Web Application Firewall (WAF) at the perimeter layer
- Nginx as reverse proxy with security headers configured
- Docker for container isolation and reduced attack surface
- PostgreSQL with schema-level security settings (RLS)
- Redis with mandatory authentication and network isolation
Encryption
| Context | Method |
|---|---|
| Sensitive data at rest | AES-256-CBC via pgcrypto |
| Secure search without decryption | HMAC-SHA256 (reference hash) |
| Data in transit | TLS 1.3 (HTTPS mandatory) |
| User passwords | bcrypt with random salt |
| OAuth tokens | AES-256 in database |
Access control (RBAC)
We implement role-based access control (RBAC v4):
- admin — internal ORQENZA team with access to the admin panel
- user — customers/tenants with isolated access to their own data
PostgreSQL's Row-Level Security (RLS) ensures each tenant can only access their own data, even in case of application layer failure.
Security perimeter (5 layers)
- Network layer — Nginx + WAF + IP-based rate limiting
- Application layer — Sanctum (authentication) + endpoint throttling
- Authorization layer — RBAC + access policies
- Database layer — RLS + schema isolation + encryption
- Audit layer — logging of all sensitive operations
Monitoring and audit
- All accesses and critical operations are logged with timestamps
- Audit logs retained for 6 months (Brazilian Internet Law)
- Automatic alerts for suspicious access attempts
- Continuous availability and anomaly monitoring
Vulnerability management
- Dependencies updated with monthly CVE checks
- Security testing before each release
- Responsible disclosure program: seguranca@orqenza.com
- Critical patches applied within 24 hours
Incident response plan
In case of a security incident:
- Detection — immediate identification and containment
- Assessment — impact classification (affected data, extent)
- Notification — affected users notified within 72 hours (Art. 48, LGPD)
- Remediation — fix and root cause mitigation
- Report — full documentation for ANPD if required
To report a vulnerability: seguranca@orqenza.com
We respond within 48 hours.
Backup and continuity
- Automatic daily database backups
- 30-day backup retention
- Restore procedure tested monthly
- RPO (Recovery Point Objective): 24 hours
- RTO (Recovery Time Objective): 4 hours
Compliance
- LGPD (Law 13.709/2018) — full compliance
- Marco Civil da Internet (Law 12.965/2014) — logs retained 6 months
- PCI DSS — payments via Stripe (level 1 certified)
Security contact
To report vulnerabilities, incidents, or security questions:
Email: seguranca@orqenza.com
Response: within 48 hours for security reports