Trust

Security

Every claim below is a mechanism, not an intention — because “we take security seriously” is what every company says the week before it doesn’t.

Last updated 24 September 2026

Staff cannot read your location

It is enforced by the database, not by a rule staff follow.

Support and administration connect through a Postgres role with no grant on the location tables. A staff member who ran the query would get a permission error, not a result. There is no “admin view” of a family map because there is nothing to build it from.

This is the difference that matters. Almost every product in this category has an internal tool that can see any customer's data, guarded by a policy and an access log. A policy is a promise; a missing grant is a fact.

Every view is written down

The audit log is append-only and hash-chained.

Each entry includes a hash of the one before it, so removing or editing an entry breaks the chain and is detectable. Nobody — including us — can quietly delete a record of having looked.

It covers views by your own family too, not only by us. If somebody in your circle opened your location at 2am, that is in the log you can read, and this was a deliberate choice: the person most likely to misuse a family tracker is in the family.

How the data is protected

In transit

TLS everywhere, with certificate verification never disabled — including between our own services.

At rest

Encrypted storage, in Brisbane. Backups are encrypted, kept off the host that made them, and restored by hand to prove they work.

A backup nobody has restored is a belief, not a backup.

On your phone

Sign-in tokens live in the Keychain on iOS and EncryptedSharedPreferences on Android, never in ordinary app storage.

Row-level isolation

Postgres row-level security is on for the tables that hold family data, so a query that forgets a WHERE clause returns nothing rather than everything.

Accounts and sessions

Passwords

Hashed with a modern memory-hard algorithm. We never see or store the password itself.

Token theft

Sign-in tokens rotate on every use. If an old one is used again — the signature of a stolen token — every session on that account is ended immediately.

Two-factor

Available, including passkeys, which cannot be phished.

Sessions you can end

Every device signed into your account is listed, with its model and when it was last seen, and any of them can be ended from any other.

Rate limiting

Sign-in attempts are limited per network, and a limit reached says so rather than reporting a wrong password.

Dependencies

Every third-party package, direct and indirect, is checked before it enters the build: how widely used it is, whether its publisher changed recently, and whether it runs code at install time. Lockfile checksums are verified on every install, and a hash that changes without a version change stops the build rather than being regenerated.

The application does not hand its whole environment to every process. Each part receives only the values it needs, so a compromised package cannot read a credential belonging to something else.

What we have not done yet

Orbities has not been through an external penetration test or a formal certification such as SOC 2 or ISO 27001. Saying so is more useful than a badge: if you are choosing between products on this basis, you now know where we are.

Reporting a problem

Write to [email protected] with enough detail to reproduce it. We will acknowledge within two business days and tell you what we are doing.

We will not pursue anybody who reports a flaw in good faith, does not access data belonging to other people, and gives us a reasonable chance to fix it before publishing.