Your data
Under your control

Security overview

How Orbelle Desktop handles project data, network connections, encryption, sign-in and updates, followed by Orbelle Server. Use it as a starting point for your own security assessment, and contact info@orbelle.net for anything it doesn’t answer.

How the app is built

Orbelle Desktop is an installed app for macOS and Windows with a native core written in Rust. It is not a browser extension and does not run a local web server. It listens for a connection only briefly during Microsoft sign-in, and only from the same computer.

The interface has no network access of its own. It runs only the app’s own code, and the native core decides which services can be reached. Links a user selects open in their default apps, and only email, phone and web links are accepted.

Where project data lives

Your organisation chooses one of three places. Your project data remains within your sovereignty.

• Locally only. In the app’s own data folder in the user’s profile (Application Support on macOS, AppData on Windows).
• Your own PostgreSQL database, on your network and accessed through your VPN. Each user signs in with their own database account.
• SharePoint lists on your own Microsoft 365 site, with each user signing in using their Microsoft work account.

With a shared register, a local copy is kept so work can carry on offline; changes are sent when the connection returns.

Remove local data in Data and settings deletes the local register, sync records and daily backups so no leftover copy can be read. It works even after a licence has ended, so data can always be removed from a computer.

Network connections

These are the only hosts the app contacts. There is no analytics, telemetry, crash reporting or AI service.

Making changes in SharePoint or the shared database also requires a current licence. With an expired or cancelled licence the app can still read and export data, but can’t change anything.

Disconnected networks

Orbelle runs fully on a network with no internet access. The app, the shared database on your own network, licences, backups, reports and the built-in user guide need no internet connection.

• Two installers: every release is provided as Orbelle, the standard edition, and Orbelle Offline, for disconnected networks, each for macOS and Windows. Your administrators choose which to deploy.
• Orbelle Offline is built with offline mode always on. There is no setting, file or update that turns its internet connections on, and only Orbelle Offline updates install on it.
• Installing Orbelle Offline can’t be reversed. Once a computer has the Offline edition, the app can’t be switched back to the standard edition. To restore the internet features, install the standard edition again; the projects saved on that computer are kept.
• Offline mode (always on in Orbelle Offline, a setting in the standard edition) stops every connection to the internet: the update check and download, Forecast, Clarity, Jira, SharePoint and Microsoft sign-in, and opening web links. It stays on until it is turned off.
• Locked by an administrator on the standard edition: Administrators can lock offline mode on for a computer, and it then can’t be turned off in the app. The administrator guide explains how.
• Database certificate check required by an administrator: Administrators can also require every connection to the shared database to check the server’s certificate.
• Updates from a file: each release is also published as offline update files for each edition, for macOS and for Windows, with release notes and checksums. The app installs a file only if it is genuine, for that platform and edition, and newer than the installed copy. Nothing changes until the user confirms.
• Central deployment: the Windows and macOS installers can also be deployed with SCCM, Intune or Jamf. Installing over an existing copy keeps each user’s data.

Encryption

• At rest, locally: the register, sync records and daily backups are protected with 256-bit encryption. The key is tied to that computer and user, so a copy of the data folder can’t be read on another computer. One backup a day is kept for the last 30 days.
• Backup files: always protected with a password (at least 10 characters) and 256-bit encryption. The password is never stored. There is no unprotected export of project data.
• In transit: every connection is encrypted.
• How project data leaves the app: only as Word and Excel reports, protected backup files, and emails a user chooses to start from a record or meeting, which open as a draft in their own email app for them to address and send. Projects are shared with colleagues through the shared database or SharePoint, not by sending files.
• Exports: Word and Excel reports are ordinary files once saved. Keep FileVault or BitLocker turned on.

Secrets

• The Forecast API key is typed in each session and held in memory only. It is never written to disk, backups, exports or the shared register.
• The Jira API token (Jira Cloud) or personal access token (Data Center) is typed in each session and held in memory only, like the Forecast key.
• The Clarity API key or password is typed in each session and held in memory only, like the Forecast key.
• The database password is asked for when the app opens and held in memory only.
• Microsoft sign-in tokens are held in memory only.

Access and accountability

• Shared database: one account per user. Every change records who made it and when. Removing more than 20 items at once needs confirmation.
• Protection against large deletions: everything removed from the shared database goes to a recycle bin first, where anyone can see who removed what and restore it, for 30 days by default. The database itself limits how much one staff account can remove, so the limits hold for any app or script, not only Orbelle. The administrator guide covers administrator accounts, backups and restore testing.
• Export log: every Word report, Excel workbook and backup file saved from the app is logged with who saved it and when. With the shared database, the export log and change history can’t be edited or deleted by any account. Without a database, the log is kept on each computer and in each project’s activity history.
• Watermarked exports: every Word and Excel export carries “Exported by <name> on <date> at <time> · Licensed to <organisation>” in the footer and under each sheet’s title, alongside any protective marking.
• SharePoint: delegated Graph permissions Sites.ReadWrite.All and User.Read, plus Sites.Manage.All for the site owner who creates the lists. Changes are version-checked, so nobody overwrites someone else’s change without seeing it.
• App lock: optional. Hides the register after a set idle time, and unlocks with Touch ID, the Mac password or Windows Hello. The operating system checks the sign-in; the app never sees it.

Updates and integrity

• Updates are signed, and the app installs an update only if it is genuine, whether it is downloaded or installed from an offline update file.
• Licence keys are signed and checked offline. A licence can be tied to one computer or cover a whole organisation. When it ends, the app becomes read-only.
• A licence key can be cancelled. The app reads a signed list of cancelled keys with each update check, or from an offline update file, and a cancelled key makes that copy read-only. The app never reports where a key is used.
• Publisher code signing for the macOS and Windows installers is being arranged. Until then, your administrators may need to allow the installer.

Software supply chain

• Native core in Rust: the native core is memory-safe Rust, and release builds stop immediately on any unexpected error.
• No PHP: the desktop app and Orbelle Server are built in Rust and JavaScript, with no PHP, web server add-ons or plug-ins, so PHP vulnerabilities don’t apply to Orbelle.
• Dependency checks: every release is built in a clean environment from fixed library versions, and checked against published security advisories before it can be published.
• Software bill of materials: each release has an SBOM listing every library it is built from. Contact info@orbelle.net for the SBOM of the version you are assessing.
• No code from the internet at run time: the interface, fonts and user guide are packaged in the app. Nothing is loaded from a content delivery network or any other outside source.

What the app doesn’t do

• It doesn’t install background services or start when the computer starts.
• It doesn’t change system settings or other apps, and uses no system-wide keyboard hooks.
• It doesn’t write outside its own data folder, except where a user chooses in a Save dialog.
• It doesn’t load help or other content from the internet. The user guide is built into the app and works offline.

Orbelle Server

Orbelle Server is installed by your administrators on your own Windows Server, Red Hat Enterprise Linux 8 or 9, or container platform (Podman, Docker, Kubernetes or OpenShift). Users work in Orbelle in the browser, or in the desktop app connected through the server. Administrators use the admin console. The server is written in Rust.

Where data lives

• The server’s own records (users, seats, sessions, settings and the audit log) are kept in its data folder, readable by the service only. Nothing else is needed to start.
• The shared register is kept where the administrator chooses: your own PostgreSQL database or SharePoint lists, optionally with the other kept up to date as a copy.
• Only the server connects to the database, encrypted and with the certificate checked, using its own account. Users don’t need database accounts, and the database can be firewalled to the server alone. Every change is still recorded under the user who made it, and the deletion limits apply to each user.
• With SharePoint, each user signs in to Microsoft from their own browser, so their tokens never pass through the server, and SharePoint’s own permissions apply.

Sign-in and access

• Orbelle accounts: passwords of at least 12 characters, never stored in a readable form. A password set by an administrator must be changed at the next sign-in.
• Active Directory: passwords are checked by your domain controller over an encrypted connection and never stored. The server’s own directory account can be set up so that no password is held. Roles come from AD groups, and a daily check releases the seats of people who have left.
• MFA: authenticator app codes for Orbelle accounts, chosen by the administrator: off (the default), optional, required for admins or required for everyone. Codes can’t be reused, and administrators can reset a user’s MFA.
• Sessions end after idle and maximum times, and administrators can sign anyone out.
• Failed sign-ins are limited and recorded in the audit log.
• Roles (Admin, Editor and Viewer) are enforced on the server for every request. Viewers can’t change anything.

Network

• HTTPS only. The browser app runs only Orbelle’s own code, can’t be embedded in other sites, and is protected against cross-site attacks.
• The administrator chooses which of the server’s addresses Orbelle serves on, which networks can connect to each, and whether the admin console is offered there. The server can be set to answer only your own DNS names. It never changes the machine’s own network settings.
• Outbound connections go only to the services you have set up (Forecast, your Clarity site, your Jira site or Atlassian’s API gateway for it, Microsoft and the update feed), always encrypted. Offline mode turns off everything on the internet; a Clarity or Jira site on your own network still works.

Records, backups and updates

• Audit log: sign-ins, admin actions, licence events, backups and restores. It can’t be edited, and the console shows if any entry has been changed or removed.
• Secrets the server needs are protected with 256-bit encryption and never written to the configuration file, the database or the logs.
• Backups are protected with 256-bit encryption and a passphrase, saved only to locations administrators approve, and restored all or nothing: if any part fails, nothing changes.
• App updates are signed and checked before an administrator installs them. The server’s program files are never changed by the server itself; the program is updated by an administrator.
• Licensing: Server licence keys are signed and tied to the installation. The server checks the signed list of cancelled keys once a day, or from an uploaded app update file. With no licence, nobody can use the app.

The service

• Windows Server: never runs as an administrator, and its data folder is restricted to the service.
• RHEL: runs as its own unprivileged user with sandboxing turned on.
• Container: runs as a non-root user with a read-only file system.
• One program: the server is a single Rust program. It needs no PHP, separate web server or plug-ins.
• Supply chain: every build is checked against published security advisories and comes with an SBOM and checksums. The container package is signed and can be checked offline.

Hosted edition

A hosted edition, run for you in the browser, is in development. It will use sign-in through your organisation’s Microsoft accounts and multi-factor authentication. This page will be updated when it is available.

Last updated 28 October 2026.