Trust, proven - not promised.
Security a CISO can check, not adjectives. Below are the concrete, verifiable controls behind OrthID - how data is isolated, where it lives, and how every change is sealed.
Two planes, isolated by design - and it fails closed.
The data plane enforces; the control plane reflects. If a check can't run, access is denied - not waved through.
Policy decisions and credential issuance live in the data plane and are enforced server-side. The console only reflects what the data plane already decided - a compromised UI can’t grant access.
When a policy, token check, or downstream dependency can’t be evaluated, the request is denied. Degraded never means open.
Every row carries its tenant. Postgres row-level security and scoped, short-lived tokens keep tenants provably apart - isolation is enforced in the database, not just the application.
Your data, your region, your keys.
Sovereignty isn’t a setting we toggle for you - it’s the default. OrthID runs as a managed, dedicated, isolated cell in your region, with customer-held keys on the near roadmap.
Pin where identity data is stored and processed. Each sovereign cell runs in a chosen region - data doesn't cross a border you didn't choose. One region runs today, with more on the roadmap.
We provision, operate, upgrade and back up a dedicated, isolated OrthID deployment in your region. Sovereignty comes from that managed cell - you get residency and control without running any infrastructure yourself.
On our roadmap: bring your own keys through HashiCorp Vault, a cloud KMS, or an HSM, so encryption keys stay under your custody and we never hold the master.
One immutable entry per change - and you can prove it.
Every action that touches identity is recorded once, hash-chained to the entry before it. Tamper with a record and the chain breaks - visibly.
Phishing-resistant by default, revocable in seconds.
Strong credentials are the baseline. When something changes, you can cut access immediately - no waiting on a ticket.
Passkeys are the default credential - phishing-resistant, biometric, and bound to the device. No shared secret to leak on a ward.
Require step-up by policy - per tenant, role, or risk signal. MFA is enforced server-side, not suggested in the UI.
See active sessions and devices, set inactivity windows, and revoke a session the moment a badge is handed back.
Designed for the frameworks your review already uses.
OrthID is engineered to support the controls behind these standards, and is GDPR-aligned by design. Formal certifications are in progress and on our roadmap; we share current status and evidence as it becomes available under NDA.
We log what happened - never the patient.
Minimise by default. The re-identification map stays in sovereign storage, and logs carry events, not payloads.
The rest of what your review will ask for.
We welcome reports from security researchers and respond on a clear timeline. See the policy and contact in our docs.
A current, versioned list of the providers we rely on and what each processes - available for your review under NDA.
Live availability and incident history. View status.
Bring this to your security review.
Walk your team through the architecture, residency model, and evidence - we'll answer the hard questions live.