Private storage
Files are held in a private Cloudflare R2 bucket, with public access disabled.
Learn more →Security & trust
Private by default
Private storage, verified accounts and workspace boundaries help you control access to your business files. Here is exactly how it works, and what it does not do.
Get started free
At a glance
Practical protection for your files
Encrypted connections
All traffic uses HTTPS, including direct uploads and downloads.
Encryption at rest
Our storage provider encrypts stored objects at rest.
Workspace isolation
Access is checked against your workspace membership on every request.
Learn more →Verified accounts
Email verification is required before uploading or accepting invitations.
Learn more →Protected passwords
Passwords are stored as secure hashes and are never retrievable, even by us.
Controlled sharing
Links have long random addresses, must have an expiry and can be revoked.
Learn more →Encrypted backups
Database, application and objects are backed up nightly to encrypted offsite storage.
Audit records
Key workspace actions are recorded on the server.
Learn more →How access works
What protects your files, in plain English
Private storage, controlled downloads
When you ask for a file, the application first checks your membership of its workspace, then issues a temporary address that lasts 15 minutes. Anyone with that address could use it during that time, so treat it as private.
Workspace membership is the boundary
Owners control who joins. Members can view, upload and manage everything in that workspace, because folders are for organisation rather than permissions. Use separate workspaces when different groups must not see each other's documents.
Sharing is deliberate
A file is only reachable by people outside the workspace when someone creates a link for it. Links expire within 30 days, can have a password and can be revoked. Revoking cannot recall copies already downloaded.
Sign-in protection
Passwords must be at least 12 characters. Repeated attempts are limited. Resetting a password signs out existing sessions, and reset links last only one hour.
Payments
Card payments are handled by Stripe. Orbis Drive does not store your card details. Stripe keys are encrypted on our server and never displayed.
Backups and retention
Backups run nightly to an encrypted offsite location and are kept for about 35 days. Files you delete stay in Trash for 30 days, then are removed from live storage, and they age out of backups after that.
Being straightforward
What is not included today
Security decisions need the full picture, so here is what the current release does not provide.
- Two-factor authentication (MFA)
- Client-side, end-to-end encryption
- Per-folder permissions or view-only members
- Single sign-on (SSO)
- Device management or remote wipe
- Independent certification such as ISO 27001 or SOC 2
- Malware scanning of uploaded files
- Self-service audit log export
Your part
Simple habits that make the biggest difference
- 1
Use a long, unique password
A password manager makes this easy.
- 2
Protect your email account
Your email address is how your password gets reset, so turn on two-factor sign-in there.
- 3
Review membership
Remove leavers the same day, and check the Team page regularly.
- 4
Share deliberately
Use the shortest sensible expiry and add a password for anything sensitive.
- 5
Sign out on shared computers
Particularly in shared offices and back-of-house PCs.
Questions
Frequently asked questions
Are files end-to-end encrypted?
No. Files are encrypted in transit and at rest with our storage provider, but the service does not provide client-side end-to-end encryption. If you need that, encrypt files yourself before uploading.
Where is my data held?
Files are stored with Cloudflare R2, application data on our managed server, and encrypted backups with a third-party offsite provider. Our Privacy Policy lists our suppliers.
Are you GDPR compliant?
We process personal data under UK data protection law. Our Privacy Policy and Data Processing Agreement set out the details. You remain responsible for deciding whether Orbis Drive suits the data you store.
How do I report a security concern?
Email support@orbisdigital.co.uk with as much detail as you can. Please do not include sensitive data in your first message.
What happens to my data if I leave?
Download what you want to keep, then ask us to close the account. See our Terms for details.