Your numbers stay in your database
Orca turns your NetSuite data into management reports, budgets and month-end commentary. This page sets out how we protect that data. Your IT or security team can request any of our policies below.
Updated 25 October 2026
Our commitments
We tell you within 24 hours of confirming an incident that affects your data.
Your figures and personal data stay in Canada, in a database you own.
The connector reads from NetSuite through a role you control. It never writes.
Access tests, a secret scan and a dependency audit must pass before any change ships.
Documents
Our policies are available to customers and prospective customers. Request one or all of them and we'll send them by email.
Controls
What is in place today, and what is planned with its date.
- Encrypted connections (HTTPS) only
- Database in your own cloud account, in Canada
- Passwords stored salted and one-way hashed (scrypt)
- Mail server password encrypted (AES-256)
- Database public interface off, row-level security on
- Admin console writes use bound parameters only
- Daily database backups, kept 7 days
- Timed restore testPlanned: December 2026
- Roles limited by subsidiary and account
- Hidden accounts filtered in the database
- Sign in with Microsoft, with your multi-factor policy
- Account locks after 5 failed attempts
- Mail server changes need your password again
- Sign-out after 30 minutes idle, 12 hours at most
- Quarterly review of our own access
- Access tests for every role on every change
- More than 3,500 automated tests
- Independent code scan: six high-severity findings closed
- Secret scan of the full code history
- Continuous dependency and code scanning
- Protected main branch with four required checks
- Authenticated security scan before each go-live
- Independent penetration testPlanned: June 2027
- Audit trail that cannot be changed or deleted
- Every sign-in attempt recorded
- Written incident response plan
- Central logs and alerts in your Azure tenantPlanned: Before go-live
- Sign-in records deleted after 13 months
- Two-step sign-in on every work account
- Firewall on, work folders private
- Encrypted work devices
- Written confidentiality obligations
- Background check before access
- Access limited to named, screened individuals
- Remote locate and erase enabled
- Yearly security training
- Named backup contact for incidents
- Policies reviewed every 12 months
How your data moves
A scheduled script inside your NetSuite reads what changed since the last run, using a read-only role you control.
Each batch is checked against a key issued for your company only, then written to your database. Nothing is kept on the way.
A database in your own Azure tenant or your own Supabase organization, in Canada. Orca reads your reports from here.
Refreshed on a schedule you set, as often as every 15 minutes.
Subprocessors
The providers involved in running Orca. We give customers at least 30 days' notice before adding one that touches their data.
| Provider | Used for | Where |
|---|---|---|
 Microsoft Azure | Hosting and database, in your own tenant | Canada Central |
 Supabase | Database, in your own organization (alternative to Azure) | Canada Central |
 Vercel | Runs Orca where you choose our hosting | Montréal |
 Microsoft Entra ID | Microsoft sign-in (optional) | Your tenant |
 Your mail server | Invitations and password resets | Your choice |
| Azure OpenAI | AI commentary, off unless you switch it on | Canada |
 Anthropic | AI commentary, off unless you switch it on | United States |
 GitHub | Source code (no client figures) | United States |
 Aikido Security | Code and dependency scanning (no client figures) | United States |
Common questions
Do you have SOC 2 or ISO 27001?
Not today. We are a small team, so instead we share our written policies, our test results and our answers to your security questionnaire, and we commit to an independent penetration test by June 2027.
Can Orca run in our own cloud?
Yes. Orca and its database can run in your own Azure tenant, built with your IT team or provider. Your administrators then control access, logs and keys.
What does the AI see?
AI commentary is off unless you switch it on. If you do, it drafts text from figures summarised by month and line, never from individual transactions. It never changes a number, and a person approves every draft.
Does Orca write to NetSuite?
Not unless you switch it on. The connector only reads. By default, budgets leave Orca as a file that a person imports into NetSuite. If you choose, Orca can send an approved budget straight to NetSuite, using a separate NetSuite token you control. You can also require a second person in Finance to approve each send.
What happens if we leave?
Your database stays yours, with all its history. Within 30 days we remove our access and confirm in writing what we deleted.
Report a vulnerability
Email security@voconsulting.ca. We acknowledge reports within two business days. Please don't test against a customer's environment or access anyone's data.