Your clients' work is not our content.
Orbit holds unreleased films, campaign cuts and invoices. The defaults assume that anything you upload is confidential until you decide otherwise.
Private by default
Assets start with no public URL. Sharing creates a scoped capability with an expiry.
Server-side checks
Every file, room and invoice is authorised on the server, not by hiding a button.
Short-lived URLs
Media streams through signed URLs that expire in minutes, not days.
View log
Every view and download through a client link is recorded, and links can be revoked at any time.
Access
Permissions that live in one place.
Roles are checked once per request against the studio, the project and the resource. The interface reads the same answer, so what you see matches what the server will allow.
- Client guests are scopedA guest link grants exactly one project, one asset set, and an expiry. No studio-wide access.
- Downloads are separateA review link can allow viewing without allowing download. Watermarks are applied per viewer session.
- Secrets never reach the pageNo storage or service keys in the interface. Writes go through the server, and the desktop app keeps its keys in Windows’ protected storage.
Infrastructure
Where the data sits.
Orbit runs on a small number of outside services. Each one is listed with what it touches.
We’ll update this list before adding a service that touches studio media.
Compliance
Honest about where we are.
Orbit does not hold a SOC 2 certificate yet, and we won’t claim one on a marketing page. Orbit is in beta: below is what is in place today and what isn’t yet.
If your client contract requires a security questionnaire, a DPA, or a subprocessor list, send us a message and we’ll answer it honestly. For studios handling regulated material, we would rather tell you plainly what is missing than sign an attestation we can't back.
What we do today
- Every studio’s data is separated by rules in the database and checked on the server for each request.
- All traffic to Orbit’s services is encrypted in transit (HTTPS).
- Client links are per recipient, with expiry, view limits, a watermark and a view log; media URLs expire within a minute.
- The desktop app runs sandboxed: the page has no access to your files or system, and it only loads Orbit’s own content.
- Updates install only if they’re signed with our release key.
- Keys on your computer are kept in Windows’ protected storage, not in plain files.
What is still on the list
- Two-factor sign-in.
- An audit log of sign-ins and permission changes.
- Automated dependency checks on every change.
- A third-party penetration test before the public launch.
- SOC 2 Type I, then Type II, when the customer base requires it.
- Data residency for EU studios.
Disclosure
Found something? Tell us first.
We don't run a paid bounty yet, but we do credit researchers who report in good faith, and we won't pursue legal action for testing that stays within the scope below.
Choose “Security” as the topic. Include what you tested, a reproduction and the impact. We read every report.
In scope
- Authentication and session handling
- Broken access control on projects, assets, invoices
- Share-link and signed-URL bypasses
Out of scope: rate limiting alone, missing headers without impact, social engineering, and testing against another studio's data.