Security
A summary for IT, security and procurement teams: what crosses the network, the controls in the app, and the services we rely on.
Data flow
OrcStat never receives the data you analyse. These are the only things that cross the network.
The engine runs on your computer, or inside your browser for the browser version.
Exports are files you save and share yourself.
Local Only mode blocks every other destination. Exposure levels decide what a model may see.
The app does not report what you do in it.
Licence ID, a hashed device ID, app version and operating system. About once a day, and the app works offline for up to 30 days.
Name, email, plan, seats, roles and registered devices.
Card details go to Paddle and never reach OrcStat.
In the app
Every control works offline and can be enforced for every seat with one admin policy file.
Local Only egress guard. AI requests are pinned to approved hosts. DNS, redirects, IPv6 and IPv4-mapped addresses are re-checked, and blocked attempts are logged.
Exposure levels 0–3. Projects choose how much an AI model may see, from variable metadata only to full data, with a preview of every request.
Encryption at rest. AES-256-GCM project files with scrypt-derived keys, encrypted autosave and recovery, and SPSS-compatible password-protected .sav.
Secrets in the keychain. API keys and passwords are stored by the operating system, never in project files or logs. Passwords are redacted from the journal.
Audit log. Each AI request records what was shared and what was approved. Export it for governance, or purge it on schedule.
Signed extensions. Extension packages are hash-checked and Ed25519-signed. An admin policy can refuse unsigned packages entirely.
Subprocessors
These providers handle account and billing data only. None of them ever sees the data you analyse.
Security reviews