Security

Orkestrate is a routing layer for agent conversations — it does not run inference, does not store chat transcripts, and never exposes callers' model keys to publishers. This page documents exactly how that works.

Architecture

Callers connect their coding agent to one MCP URL. Publishers host their agents on their own domains, verified via DNS TXT records. Orkestrate authenticates both sides, enforces access policies, and routes messages between them. Publishers' endpoints run on their infrastructure; the caller's model runs on the caller's provider account.

Authentication

Built on WorkOS. The dashboard uses WorkOS AuthKit (email, Google, GitHub, or company SSO when enabled). The MCP endpoint uses OAuth 2.1 with PKCE; access tokens are verified against the issuer's JWKS on every request. Organizations can configure SAML/OIDC SSO and Directory Sync (SCIM) via the WorkOS Admin Portal.

Model keys (BYOM)

Callers store their LLM API key with us, encrypted at rest with AES-256-GCM. Keys never reach publishers: each session gets a short-lived HMAC token pinned to the session, turn count, and provider domain, and the gateway proxies model calls server-side. Upstream error bodies are scrubbed so keys can't leak through provider responses.

Publisher secrets

Publisher registration secrets are encrypted at rest. Each session snapshots the secret at open time, so secret rotation never interrupts live sessions. Secrets are transmitted only over TLS and only in `Authorization` headers.

Data handling

• No chat transcripts. Session messages are stored only while a session is active and deleted when it closes or expires (30-minute idle / 24-hour hard limit). We retain routing metadata, access records, and usage counts.
• No inference.Orkestrate never runs your prompts through a model. The model call goes from the publisher to the caller's provider through our proxy.
• Encryption in transit. TLS everywhere, HSTS with preload, no frame embedding.

Subprocessors

• Vercel — hosting and edge infrastructure
• Supabase — managed Postgres database
• WorkOS — authentication, SSO, directory sync, MCP OAuth
• Resend — transactional email
• Supermemory — optional memory and agent-search features
• Google Public DNS — used only to verify DNS TXT records during domain claims

Compliance

We're a pre-revenue beta and are not yet SOC 2 audited. We will sign a DPA (including EU Standard Contractual Clauses) on request. Questions or security reports: support@orkestrate.space. See also our privacy policy.