Trust Center
Policy, evidence, and the documents behind them.
Everything governing how OrcaRouter handles your data, what our controls enforce at request time, and how to reach us about security — each claim linked to the document that backs it.
CONTINUUM AI PTE. LTD.
- 32Regulatory frameworks mapped in the compliance engine
- ZDRZero data retention available on supported routes
- 3Enforcement layers — guardrails, firewall, evidence
- SG · US · JPInfrastructure regions serving the platform
Certifications
Certifications and commitments
Independent audits of our security and privacy programme, plus the contractual instruments that carry coverage where no certification exists. Reports and certificates are available to customers and prospects under NDA.
SOC 2 Type II
Type II reportIndependent audit of our security, availability and confidentiality controls against the AICPA Trust Services Criteria.
ISO/IEC 27001:2022
CertifiedCertified information security management system covering the platform and the organisation that operates it.
HIPAA
BAA availableBusiness Associate Agreements are available for workloads that process protected health information.
GDPR
DPA + SCCsData Processing Addendum with Standard Contractual Clauses for transfers out of the EEA, the UK and Switzerland.
To request documentation, email [email protected]
Legal
The documents
The binding agreements between you and the operating entity. Each carries its own effective date and version history.
Infrastructure
Where your requests run
A workspace declares its region. Compliance evidence is stamped and stored under it, and a cross-region read is refused. It does not geo-pin inference: upstream providers process requests in their own regions, listed in the subprocessor table.
- SGSingapore
- USUnited States
- JPJapan
- Configurable
Data residency controls
Declare a region and every compliance artifact is stored region-partitioned under it. This is a disclosure and an evidence-locality control, not a routing filter. Data Residency & Privacy - On request
International transfers
Transfer mechanisms are set out in the Privacy Policy — the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards per jurisdiction. A Data Processing Addendum is available for business customers. Privacy Policy
Data handling
What happens to your content
How request content and account data move through the platform.
- Available
Zero data retention
Available on supported routes. When enabled, request and response content is processed in memory and not persisted. - Never
Training on your content
We do not use your prompts or completions to train models. Upstream providers are bound by their own terms. Terms of Service - Documented
Retention periods
Account data, usage metadata and logs each have a defined retention window. Privacy Policy - Exercise
Your rights
Access, correction, deletion, portability and objection under GDPR, UK GDPR and CCPA. Privacy Policy
Product controls
Policy runs before the spend
Where these controls are enabled, input-stage policy is evaluated at the gateway before the upstream call is made or billed. Output-stage checks necessarily run after the model has responded, so those calls are already billable even when the response is blocked or redacted.
Coverage
Framework coverage
Regulatory frameworks our compliance engine maps to enforceable policy, with per-control citations to the authoritative source text.
Security6
- AICPA SOC 2 Trust Services Criteria
- ISO/IEC 27001:2022
- OWASP Top 10 for LLM Applications
- NIST SP 800-53 Rev. 5 / FedRAMP
- CMMC 2.0
- HITRUST CSF v11
AI governance4
- EU Artificial Intelligence Act
- NIST AI Risk Management Framework 1.0
- ISO/IEC 42001:2023
- Colorado AI Act (SB 26-189)
Privacy — global11
- EU GDPR
- UK GDPR + DPA 2018
- CCPA / CPRA
- PIPL + Generative AI Measures
- APPI (Japan)
- PIPA (Korea)
- LGPD (Brazil)
- PIPEDA + Quebec Law 25
- DPDP Act 2023 (India)
- Privacy Act 1988 + APPs (Australia)
- PDPA (Singapore)
Privacy — US state5
- Virginia CDPA
- Colorado Privacy Act
- Connecticut DPA
- Utah CPA
- Texas TDPSA
Financial3
- PCI DSS 4.0
- Digital Operational Resilience Act
- Gramm-Leach-Bliley Act
Healthcare, education & minors3
- HIPAA Security & Privacy Rule
- FERPA
- COPPA Rule
These are frameworks the OrcaRouter compliance engine maps to policy and evidence. Listing one here describes a product capability, not an audit — the certifications and attestations we do hold are named under Certifications and commitments above, and the reports are available under NDA.
Disclosure
Report a vulnerability
If you have found a security issue in OrcaRouter, we want to hear about it.
We will not pursue legal action against researchers acting in good faith under this policy: test only against your own account, avoid accessing or modifying other users’ data, do not degrade the service, and give us reasonable time to remediate before disclosing publicly.
Please do not run automated scanners against production endpoints, and do not attempt social engineering against our staff or providers. Report issues in a third-party provider to that provider directly.
- Contact
- [email protected]
- Machine-readable
- /.well-known/security.txt
- First response
- Within 3 business days
- Scope
- orcarouter.cyou and *.orcarouter.cyou
Contact
Reach the right team
Direct lines for security, privacy and contracts.
- Security reports
- [email protected]
- Privacy requests
- [email protected]
- Data Protection Officer
- [email protected]
- Legal & contracts
- [email protected]
