oryn← Back to oryn.app
Trust

Security & Trust

Oryn handles email, financial, health, and calendar data, so security is built into the architecture rather than bolted on. This page describes our practices in plain language.

Data minimization

  • Apple Health stays on your device. We read health metrics locally and send only rounded daily totals for summarization — never raw HealthKit samples.
  • No third-party tracking. Oryn ships with no analytics, advertising, or tracking SDKs.
  • We request the narrowest permissions each integration needs (e.g. Gmail archive-by-label rather than full mailbox deletion).

Encryption

  • In transit: all traffic between the app, our servers, and third-party providers uses TLS.
  • At rest: sensitive connected-account credentials — Gmail and Plaid tokens — are encrypted in our database using authenticated symmetric encryption (PostgreSQL pgcrypto). Encryption keys are held in a secrets vault and are accessible only to privileged server-side functions, never to the app.
  • On device: OAuth tokens stored on your device are kept in the iOS Keychain (Secure Store).

Access control

  • Row-level security (RLS) enforces that you can only ever read or write your own data.
  • Token isolation: raw account credentials are never exposed to the app. The app can check that a connection exists but cannot read the underlying tokens; only server-side functions can decrypt them, through a controlled function layer.
  • Least privilege: API keys for AI, financial, and content providers live only on the server as protected secrets, never in the app bundle.

Authentication

  • Sign in with Apple is the only way to sign in. There are no passwords, one-time codes, or magic links — so there is no credential to phish, guess, or leak.
  • Sessions are managed by our authentication provider (Supabase Auth).

Third-party providers

We rely on established providers — Supabase (infrastructure), Anthropic (AI), Plaid (financial connectivity), Apple and RevenueCat (sign-in and subscriptions), and Expo (notifications). Plaid and our infrastructure provider maintain their own industry security certifications.

Compliance & certifications

Oryn is not currently SOC 2 audited. We follow many of the underlying practices today — encryption in transit and at rest, least-privilege access, per-user data isolation, and no third-party tracking. As Oryn grows, we plan to pursue formal third-party security assessments. If you’re evaluating Oryn for your organization and need specific security information, contact us at [Contact email].

Your controls

  • Disconnect any integration at any time; access is revoked and stored data for that connection is deleted.
  • Delete your account in-app to permanently remove your data and revoke third-party access.
  • Revoke Oryn’s Google access anytime at myaccount.google.com/permissions.

Reporting a vulnerability

If you have found a security vulnerability in Oryn, please report it to security@[DOMAIN]. We would rather hear from you than not.

What to include

A description of the issue, the steps to reproduce it, and what an attacker could do with it. A proof of concept helps.

What we commit to

  • We acknowledge every report within 3 business days.
  • We give you an assessment and a remediation timeline within 10 business days.
  • We tell you when the fix ships, and we credit you if you would like to be credited.

What we ask

Please give us a reasonable window to fix an issue before disclosing it publicly. Please do not access, modify, or delete data belonging to anyone but yourself — if you need a second account to demonstrate an issue, tell us and we will provide one. Please do not run automated scans that degrade the service for other users.

Safe harbour

We will not pursue legal action against researchers who follow this policy in good faith.

Scope

The Oryn iOS app, the Supabase project that serves it, and [DOMAIN]. Third-party services we depend on (Supabase, Google, Plaid, Anthropic, RevenueCat, Expo) have their own disclosure programmes — please report issues in those products to them directly.

Out of scope

Findings without demonstrated security impact: missing headers on static pages, rate-limiting on unauthenticated endpoints, self-XSS, social engineering, and reports generated by an automated scanner without a working proof of concept.

We do not currently run a paid bug bounty.

See also /.well-known/security.txt for the machine-readable version of this policy.