Security and privacy

Private by design, not by promise.

Your mail, your conversations and your passwords are sealed on your device before they reach us, with keys that come from your password and never leave your hands. Here is how it works, and exactly where the line is.

Create a free account What each app stores
  • No adsNot in any app, not on this site, not ever.
  • No trackersNo advertising or analytics trackers anywhere in Orbit.
  • No training on youWe never train AI on what you write or store.
  • No password on our sideWe never see or store your password.
  • No sellingWe don't sell or rent your information to anyone.
One password, one key

Your password unlocks everything, and never leaves your browser.

Signing in to Orbit does two jobs at once: it proves who you are, and it gives your device the key to your sealed data. The two are split apart before anything is sent.

  1. 1

    You type your password

    On Orbit's sign-in page, in your browser.

  2. 2

    Your browser stretches it

    PBKDF2-SHA256, 600,000 rounds, salted with your email, then split in two with HKDF.

  3. 3
    Sent

    An auth key

    Mission Control stores a hash of it, as it would a password. It can't be turned back into your password or your keys.

    Kept

    A vault key

    Stays in your browser, and is handed to each app in the part of a web address no server receives.

  4. 4

    Your device derives your identity

    Two P-256 key pairs, the same on every device you sign in on. Only the public halves are uploaded.

  • Orbit Mail seals each message to it.
  • Orbit Chat wraps each channel's key to it.
  • Orbit Pass wraps each vault's key to it.
The ledger

What each app stores, in plain words.

"Sealed" means encrypted on your device with keys we never hold. Everything in the right-hand column is what our servers can read.

App Sealed on your device What our servers can see
Orbit Mail Message bodies and attachments, in both directions Sender, recipients, subject, date, size, the headers that thread replies, the junk score
Orbit Calendar Not end-to-end encrypted Each event's title, time, place, attendees and notes
Orbit Chat Messages, channel names and files; calls go device to device Who is in each channel, who sent each message and when, sizes, call lengths, who is online
Orbit Pass Logins, passwords, passkeys, codes, cards, details, notes and vault names Which vaults exist, who is in each, how many items they hold, sizes and times; a login's domain when website icons are on
Orbit AI Not end-to-end encrypted Your conversations, Projects, settings and usage. What you ask goes to the one provider the model you pick is pinned to
Mission Control Your password and vault key never leave your browser Your email, name, picture, workspaces, roles and plan; a hash of the derived auth key
Orbit IDE Everything stays on your computer That it checked for an update
Orbit Browser Your browsing stays on your computer That it checked for an update. No telemetry, studies or Mozilla account
Orbit Relay Message bodies, sealed to the reader's key before anything is stored The envelope (sender, recipients) needed to route mail; and, for the instant it seals an incoming message, its plaintext in memory
Orbit MDM Not end-to-end encrypted (secrets encrypted at rest) Each device's inventory and compliance, its policies and commands and their results, and FileVault and BitLocker recovery keys, Wi-Fi passwords and Apple and Google tokens, encrypted at rest
Orbit RMM Not end-to-end encrypted Each computer's health, hardware and software inventory, patch status, and the scripts and commands run on it with their output

The Privacy Policy has the full list, including which companies help run each app.

Standards, not secrets

Well-known cryptography, done the same way everywhere.

There is no home-made cryptography in Orbit. The browser uses WebCrypto, the apps use the platform's own libraries, and every implementation is tested against the same vectors.

AES-256-GCM

Every message, file and vault item, with a fresh key and nonce, authenticated so tampering shows.

P-256 ECDH and ECDSA

Keys are wrapped to each reader, and every vault key envelope is signed by whoever wrapped it.

PBKDF2 and HKDF

600,000 rounds of SHA-256 before anything leaves the browser, then HKDF to keep every key separate.

Keys that can't be read

In the browser, private keys are kept as non-extractable WebCrypto keys: even the page's own script can use them but not copy them out.

One format, tested everywhere

The web, the apps and the server implementations must agree byte for byte, checked against shared test vectors on every build.

Open-source relay

The part that seals your incoming mail is public, so you can read it, and run it on your own server.

Orbit Relay

Your mail is sealed the moment it arrives. On our server, or yours.

The relay is the only machine that ever sees an incoming message readable, for the instant between receiving it and sealing it to your key. The readable message is never written to disk. Run Orbit's, or install your own with one command and keep even that instant on a machine you control.

Self-host the relay How mail encryption works
Where the line is

What end-to-end encryption doesn't cover.

Any service that tells you it protects everything is selling something. These are the limits, so you can decide with your eyes open.

Who and when
Mail and chat need to be delivered, so our servers see who talks to whom and when. The words stay sealed.
Mail that leaves Orbit
Mail you exchange with other providers is readable on their servers, as it always was. Orbit Mail shows a green lock only on conversations that stayed within Orbit.
Orbit AI and Calendar
AI conversations and calendar events are stored in a form we can read. A hosted model has to read what you ask it.
Mail notifications
How loudly new mail notifies is decided on our server from its sender and subject, before any device has the mail. The category isn't stored.
A lost password
Reset it and carry on, but data sealed to the old key opens only with the old password. Nobody can recover it for you, including us.
Apps in a browser tab
A web app's code comes from our server each time it loads. The Mac, Windows and Linux apps and the browser extension are signed builds that don't depend on that.

Found a security problem?

Write to hello@orbit.com.ai with what you found and how to reproduce it. We read every report, aim to acknowledge it within three business days, and we'll tell you what we did about it. The address is also in our security.txt.

Please report privately and give us a reasonable chance to fix the issue before telling anyone else. Test only against your own account, don't access or change other people's data, and don't run denial-of-service or spam tests. Act in good faith within these limits and we won't pursue action against you.

Keep your work yours.

Encrypted mail, chat and passwords, with small AI on your device. Free to start, and one plan covers every app.

Create a free account On-device AI