Security & trust
How we protect your code, data and IP · Last updated Oct 28, 2026
Your code and IP
Code lives in your GitHub organization from the first commit. IP transfers to you on payment of each milestone.
Access control
Least-privilege access, SSO with MFA, and access removed the day an engagement ends.
- Mutual NDA before discovery
- Background-checked engineers
- Separate credentials per client
Infrastructure
Production runs in your cloud account. Secrets live in a vault, never in code. Dependencies are scanned on every pull request.
Compliance
We build to HIPAA and SOC 2 controls for healthcare and fintech clients and support your audits. Orva’s own SOC 2 Type II report is in progress.
Incident response
We notify you within 24 hours of any confirmed incident affecting your systems, with a written report within 5 business days.
Report a vulnerability
Email security@orvalabs.com. We reply within 2 business days.
Questions about this policy? privacy@orvalabs.comContact us