Your data stays in the EU
Describing a process needs no access to your systems. If you turn on monitoring, Orbox only reads the tools you connect yourself and never changes anything in them. Everything is stored and processed in the European Union.
- Data stored in the EU
- Hosted in the EU
- GDPR compliant
What Orbox sees, and what it never does
Your developer builds the automation in your own infrastructure. Orbox hands them the plan, then checks that every step really happens.
Stays with you
- The ability to change anything in your systems
- Passwords for your apps
- Any tool you haven’t connected yourself
- The code your developer writes
Orbox sees
- Your process, the way you described it
- The steps, roles and rules Orbox mapped from it
- Names and emails of your Orbox team members
- If you turn on monitoring: the records in your connected tools that show a step took place
Secure by default. Nothing to configure.
There’s nothing to switch on. Every protection applies to every account, including the free one.
EU data residency
Orbox runs in the European Union. Your database, backups and every process you describe are stored and processed in the EU.
GDPR compliant
We process personal data under the GDPR. Our DPA and full subprocessor list are public, right below.
Encrypted in transit and at rest
Everything travels over an encrypted connection (TLS), and stored data is encrypted at rest.
Secure sign-in
Passwords are never stored in readable form. You can also sign in with Google Workspace.
Isolated workspaces
Every company gets its own separate workspace. No other company can ever see your data.
No training on your data
We never use your processes to train AI models, and neither does our AI provider.
GDPR and paperwork. Already sorted.
Everything your lawyer or DPO will ask for is public. No email needed.
Data processing agreement (DPA)
Read it now. It is part of the terms of every account.
Subprocessor list
Every service that touches your data, and the country it runs in.
Data deletion
Ask, and we delete your account and all its data within 30 days.
Data export
Download your processes whenever you like. No lock-in, ever.
Claude access, fully under your control
Your developer connects their own Claude, and it only gets what it needs from Orbox to build the automation.
See how the connection worksRead-only
Claude reads the process and its steps. It can never change or delete anything in Orbox.
One process at a time
It only gets access to the process you share, never your whole workspace.
Revoke in one click
Disconnect whenever you like. Access ends instantly.
Security questions
What IT leads and lawyers ask us most. Can’t find yours? Just ask.
Where is my data stored?
In the European Union. The app, database and backups all run in the EU, and every process you describe is processed there too.
Does Orbox need access to our systems?
Not to describe a process. That only needs your words. Monitoring is optional: to check that a process really runs, Orbox reads from the tools you connect yourself, sees only the records it needs to confirm each step, and never changes anything in them. You can disconnect a tool at any time. The automation itself is built by your developer in your own infrastructure.
Do you train AI on our processes?
No. We never use your processes to train AI models, and our AI provider is contractually barred from doing so.
What can Claude see once a developer connects it?
Only the steps of the process you share, read-only. Claude runs under your developer’s own Anthropic account, so their (or your company’s) terms with Anthropic apply. You can revoke access at any time.
Are you ISO 27001 or SOC 2 certified?
Not yet, and we won’t pretend otherwise. If your audit requires a security questionnaire, get in touch and we’ll work through it with you.
Will you sign a DPA?
Yes. We’ll send you a ready-to-sign data processing agreement and our subprocessor list. Just use the form below.
Are Orbox Partners bound by confidentiality?
Yes. Confidentiality is part of the Partner Program Terms every Partner accepts, and it continues after the Partner leaves. A Partner only gets the access you choose to give it.
How do I report a security issue?
Use the form on this page and choose “Report a security issue”. Every report gets priority attention.
Have a security questionnaire?
Send it over and we’ll work through it with you, or answer anything the public documents don’t cover. We’re an EU company, so everything follows EU rules.