SECURITY POSTURE

OrgX security and data handling

Review what OrgX receives, how local hooks differ from hosted MCP, and which controls need deployment-specific evidence.

Last updated September 7, 2026

Try OrgX in the browser without local hooks

Secure by design

Review the requested scopes and use synthetic data before connecting a work environment.

Least privilege by default

Workspace access and connector permissions determine which records a client can read or change.

Reviewable activity

Use available activity records and request identifiers when reporting an issue. Coverage depends on the surface.

Verifier-ready controls

The security review path is explicit.

Reviewers should not have to infer whether OrgX has scoped OAuth, audit history, exportability, permission boundaries, or a retention story. These are the concrete controls and routes we can point to today.

OAuth scopes

Connector access is scoped before it reaches the agent layer.

MCP pairing starts from authenticated user intent and moves through a consent step where connector permissions are approved before tools are exposed.

Review packet includes the consent flow, session-lifetime policy, and scope-to-tool mapping without publishing internal routes.

Permission boundaries

Review identity and workspace permissions before granting access.

Workspace operations use endpoint-specific authentication and authorization. Review the current API contract and requested workspace before a write.

Review packet includes the control model and representative policy evidence without exposing internal handler names or privileged route inventory.

Audit trail proof

Use available audit records to investigate mutations.

Audit evidence can identify an actor, workspace, target, event, and timestamp. Confirm coverage for the action under review.

Authenticated reviewers can request timestamped audit extracts through support or in-product export paths.

Data export

Exports are explicit endpoints, not hidden support work.

Usage exports, learned-workspace exports, and audit extracts are explicit authenticated workflows. Unsupported export surfaces fail closed instead of implying silent coverage.

Review packet lists available export types, formats, requester requirements, and expected response behavior without publishing internal route templates.

Retention policy

Retention is documented by data class and reviewed during security requests.

Backups, operational logs, and workspace records have separate lifecycles. The data-handling summary below identifies what is documented and what still needs deployment-specific evidence.

Request current retention, backup, and deletion evidence for the specific deployment.

Export walk-through

What a buyer gets during diligence

The export path is meant to be boring: authenticated, timestamped, no-store responses that can be attached to a security review without manual reconstruction.

01Sign in to OrgX and choose the workspace or center under review.
02Export billing usage as CSV from the authenticated billing export flow.
03Export learned workspace context as JSON from the authenticated workspace export flow.
04For audit evidence, request a timestamped audit extract scoped to the relevant workspace and entity class.
05Attach the CSV, JSON, and audit rows to the customer security packet with the generated timestamp intact.

Data handling

What OrgX receives

Hosted MCP receives the tool arguments your client sends and returns tool results. These can include prompts, queries, decisions, artifact text or links, and workspace identifiers.
OrgX also handles account, connection, authorization, and operational records needed to run the service. A browser-only trial is not offline or zero-data-retention.

Local hooks are a separate integration

Adding the hosted MCP URL in a browser client does not install the OrgX wizard, local plugins, or session hooks. Do not enable other connectors or upload real files for the synthetic-data trial.
Local wizard and plugin setup can change client configuration and install capture hooks. Depending on the client and enabled capture, records can include session IDs, working-directory and transcript paths, timestamps, event and tool counts, summaries, and work context. Review the specific integration before installing it on a machine containing employer code.

Retention policy

Durable workspace records remain until removed through an authorized product workflow, a workspace deletion request, or an applicable retention policy. Do not assume trial records expire automatically.
Connection state, operational logs, and provider backups have separate lifecycles. This public summary does not establish a fixed retention period for those classes; request the current deployment-specific details before sending sensitive data.

Disconnecting and deleting data

Disconnect the client and revoke the relevant credentials to stop future access. This does not delete records already stored in OrgX or copies held by your AI provider.
Review and delete the trial records through authorized OrgX tools or request workspace deletion through support. Ask for confirmation of the scope and remaining backup or provider copies. This summary does not promise a hard-delete completion time.

Encryption and evidence

The hosted MCP endpoint uses HTTPS. The privacy policy describes TLS in transit and encryption at rest where supported by the underlying provider. This is not end-to-end encryption: OrgX and the services processing a request can process its content.
A specific TLS version, storage cipher, backup schedule, recovery-drill cadence, or deletion SLA requires current deployment evidence. This page is not a compliance attestation; request that evidence at [email protected] before a work-data evaluation.

Processor review

Download the security review packet.

The one-pager summarizes controls, export routes, and processor coverage. The sub-processor page maps each provider to purpose, data categories, and operating controls for buyer diligence.

Download PDF View sub-processors

Incident response & transparency

Report a suspected issue with the minimum redacted evidence. Do not include secrets, raw transcripts, or employer code. Response commitments depend on your applicable agreement.

[email protected]

Detect

Report the affected surface, time, and redacted request identifiers.

Stabilize

Isolate impacted services, rotate credentials, and enable maintenance mode where necessary.

Notify

Confirm the observed impact and communicate verified scope and remediation guidance.

Learn

Use the incident findings to prioritize fixes and regression checks.

Back to Home

SECURITY POSTURE

OrgX security and data handling

Review what OrgX receives, how local hooks differ from hosted MCP, and which controls need deployment-specific evidence.

Last updated September 7, 2026

Try OrgX in the browser without local hooks

Secure by design

Review the requested scopes and use synthetic data before connecting a work environment.

Least privilege by default

Workspace access and connector permissions determine which records a client can read or change.

Reviewable activity

Use available activity records and request identifiers when reporting an issue. Coverage depends on the surface.

Verifier-ready controls

The security review path is explicit.

OAuth scopes

Connector access is scoped before it reaches the agent layer.

MCP pairing starts from authenticated user intent and moves through a consent step where connector permissions are approved before tools are exposed.

Review packet includes the consent flow, session-lifetime policy, and scope-to-tool mapping without publishing internal routes.

Permission boundaries

Review identity and workspace permissions before granting access.

Workspace operations use endpoint-specific authentication and authorization. Review the current API contract and requested workspace before a write.

Review packet includes the control model and representative policy evidence without exposing internal handler names or privileged route inventory.

Audit trail proof

Use available audit records to investigate mutations.

Audit evidence can identify an actor, workspace, target, event, and timestamp. Confirm coverage for the action under review.

Authenticated reviewers can request timestamped audit extracts through support or in-product export paths.

Data export

Exports are explicit endpoints, not hidden support work.

Usage exports, learned-workspace exports, and audit extracts are explicit authenticated workflows. Unsupported export surfaces fail closed instead of implying silent coverage.

Review packet lists available export types, formats, requester requirements, and expected response behavior without publishing internal route templates.

Retention policy

Retention is documented by data class and reviewed during security requests.

Backups, operational logs, and workspace records have separate lifecycles. The data-handling summary below identifies what is documented and what still needs deployment-specific evidence.

Request current retention, backup, and deletion evidence for the specific deployment.

Export walk-through

What a buyer gets during diligence

The export path is meant to be boring: authenticated, timestamped, no-store responses that can be attached to a security review without manual reconstruction.

01Sign in to OrgX and choose the workspace or center under review.
02Export billing usage as CSV from the authenticated billing export flow.
03Export learned workspace context as JSON from the authenticated workspace export flow.
04For audit evidence, request a timestamped audit extract scoped to the relevant workspace and entity class.
05Attach the CSV, JSON, and audit rows to the customer security packet with the generated timestamp intact.

Data handling

What OrgX receives

Hosted MCP receives the tool arguments your client sends and returns tool results. These can include prompts, queries, decisions, artifact text or links, and workspace identifiers.
OrgX also handles account, connection, authorization, and operational records needed to run the service. A browser-only trial is not offline or zero-data-retention.

Local hooks are a separate integration

Adding the hosted MCP URL in a browser client does not install the OrgX wizard, local plugins, or session hooks. Do not enable other connectors or upload real files for the synthetic-data trial.
Local wizard and plugin setup can change client configuration and install capture hooks. Depending on the client and enabled capture, records can include session IDs, working-directory and transcript paths, timestamps, event and tool counts, summaries, and work context. Review the specific integration before installing it on a machine containing employer code.

Retention policy

Durable workspace records remain until removed through an authorized product workflow, a workspace deletion request, or an applicable retention policy. Do not assume trial records expire automatically.
Connection state, operational logs, and provider backups have separate lifecycles. This public summary does not establish a fixed retention period for those classes; request the current deployment-specific details before sending sensitive data.

Disconnecting and deleting data

Disconnect the client and revoke the relevant credentials to stop future access. This does not delete records already stored in OrgX or copies held by your AI provider.
Review and delete the trial records through authorized OrgX tools or request workspace deletion through support. Ask for confirmation of the scope and remaining backup or provider copies. This summary does not promise a hard-delete completion time.

Encryption and evidence

The hosted MCP endpoint uses HTTPS. The privacy policy describes TLS in transit and encryption at rest where supported by the underlying provider. This is not end-to-end encryption: OrgX and the services processing a request can process its content.
A specific TLS version, storage cipher, backup schedule, recovery-drill cadence, or deletion SLA requires current deployment evidence. This page is not a compliance attestation; request that evidence at [email protected] before a work-data evaluation.

Processor review

Download the security review packet.

The one-pager summarizes controls, export routes, and processor coverage. The sub-processor page maps each provider to purpose, data categories, and operating controls for buyer diligence.

Download PDF View sub-processors

Incident response & transparency

Report a suspected issue with the minimum redacted evidence. Do not include secrets, raw transcripts, or employer code. Response commitments depend on your applicable agreement.

[email protected]

Detect

Report the affected surface, time, and redacted request identifiers.

Stabilize

Isolate impacted services, rotate credentials, and enable maintenance mode where necessary.

Notify

Confirm the observed impact and communicate verified scope and remediation guidance.

Learn

Use the incident findings to prioritize fixes and regression checks.