How we protect your customers and your data
Clients trust us with their customers’ conversations, accounts and sometimes their systems. This page explains the standards we work to as a fully remote team, and how security is agreed for each engagement.
Our principles
Four ideas shape every engagement.
This page describes our standard approach. The controls that apply to a client are agreed in writing for that engagement. Nothing here is a certification, audit result or warranty.
- Least privilege
- People get only the access their role needs, for only as long as they need it.
- You stay in control
- Your systems, your data and your rules. We work inside the tools and limits you approve.
- Collect less
- We avoid copying customer data out of your systems and keep what we hold to what the work needs.
- In writing
- Security controls, data handling and incident duties are set out in each client agreement.
People
Security starts with who we hire and how we prepare them.
Screening
Background and reference checks where the law allows and the engagement calls for them, agreed with each client.
Confidentiality
Everyone who works on client accounts signs confidentiality terms before getting access.
Training
Security and privacy training is part of Orílé Academy before go-live, with refreshers and client-specific rules added for each engagement.
Leaving a team
When someone moves off a client team or leaves, we aim to remove their access promptly and recover company equipment.
Remote workspaces
Our home-office standard is designed to give a remote team the controls of a secure office.
- Devices
- Company-managed or approved devices with disk encryption, endpoint protection and automatic updates. Client data is not handled on personal devices.
- Sign-in
- Multi-factor authentication on work accounts, and single sign-on where the client offers it.
- Connection
- Secure remote access, such as a virtual desktop or VPN, depending on the client’s platform.
- Workspace
- A private space where screens and calls can’t be overseen or overheard, checked before go-live.
- Data loss
- Restrictions on printing, downloads, removable storage and screen capture, where the tools allow.
Access to your systems
Especially important for technical support, where our team may work inside your products.
Named accounts
Each person uses their own account, never a shared login, so every action can be traced.
Approved runbooks
Hands-on Tier 3 tasks follow written runbooks you approve, and changes are logged.
Customer consent
We ask the customer’s permission before any screen share or remote session.
No surprise production access
No access to production systems without your written sign-off, and regular reviews of who has access.
Data handling
When we handle your customers’ information, we do so on your behalf and under your instructions.
- Where data lives
- In your systems or platforms agreed with you, not in personal email, chat apps or spreadsheets.
- Use
- Only to deliver the agreed services. We do not sell personal information.
- Retention
- Kept or deleted according to your instructions and the client agreement.
- Payments
- Where the platform supports it, card details are captured without agents seeing or hearing them. We take on payment-card work only when it is agreed in writing.
- Incidents
- We keep an incident response process and notify affected clients as required by the client agreement and applicable law.
Compliance
Straight answers for your security and procurement teams.
We are a new company and do not currently hold third-party security certifications. As we grow, we intend to work toward frameworks clients commonly ask about, such as SOC 2, ISO/IEC 27001 and, for payment work, PCI DSS. These are goals, not commitments or claims of compliance.
We can agree data processing terms with clients where privacy laws such as the GDPR, UK GDPR or US state privacy laws require them. Our Privacy Policy explains how we handle information on this website.
If your work involves regulated information, such as health, financial or payment data, tell us early so we can confirm whether and how we can support it before any proposal.
We’re happy to complete your security questionnaire and walk your team through our controls during the proposal stage.
Report a security issue
If you believe you’ve found a security problem with this website or our services, please tell us.
Email contact@orilenetworks.com with “Security report” in the subject. Include what you found, where, and how to reproduce it.
Access or change data that isn’t yours, disrupt our services, or test against our clients’ systems. Give us reasonable time to fix an issue before sharing it publicly.
We aim to acknowledge reports promptly and keep you updated. We don’t currently offer a paid bug bounty.
Have security requirements to discuss?
Tell us what your team needs and we’ll go through it in the discovery call.