Security Overview
On this page
Tenant isolation Authentication Data protection Infrastructure Access control Reporting a concernTenant isolation
Every organization's data is scoped by a real organization ID, enforced on every single database query — not just filtered in what the screen happens to display. This isn't a claim we make and leave untested: our own real, automated tests attempt to cross tenant boundaries directly (including with deliberately forged access tokens) and confirm those attempts are rejected, before any release goes out.
Authentication
Passwords are never stored in readable form. Sessions use short-lived access tokens paired with a separate refresh token; refresh tokens rotate on every use, so a stolen-but-unused token becomes detectable if it's ever replayed. Invitation links and password reset links are single-use, time-limited, and stored as a hash rather than the raw value.
Data protection
Traffic between your browser and OrgAlyne is encrypted in transit (HTTPS/TLS). Uploaded files (documents, logos, photos) are stored in dedicated object storage, separate from the application database, with metadata — who uploaded it, when, what it's linked to — kept in the database rather than embedded in the file itself.
Infrastructure
OrgAlyne is built on a small number of established infrastructure providers, rather than self-hosted servers we maintain ourselves:
| Function | Provider |
|---|---|
| Application hosting | Railway |
| Database | PostgreSQL, hosted on Railway |
| Frontend hosting | Netlify |
| Payment processing | Stripe |
| Transactional email | Resend |
We don't store full payment card numbers ourselves — that's handled directly by Stripe, a PCI-compliant payment processor.
Access control
Within your organization, OrgAlyne enforces real, role-based permissions — what a Committee Member can do is genuinely different from what an Org Admin can do, checked on every request, not just hidden from view in the interface.
Reporting a security concern
If you believe you've found a real security issue, please tell us directly and privately at hello@orgalyne.com rather than filing it publicly. We take these reports seriously and will respond.