Orgo is built and operated in the European Union, for organizations that hold data about their members, volunteers and beneficiaries. This page states where your data lives, who can reach it, how it survives a bad day, and what we can prove.
This page is our security whitepaper. If your IT department, your board or your procurement team asked you for one, send them here. It is written to be read by a security reviewer, not to be admired. Where a legal document already answers a question, we link to it rather than restate it — one statement of an obligation is easier to keep true than two.
Nothing on this page is aspirational. Every technical statement describes the system as it runs today, and we say plainly where a control is still in preparation.
The short version, for the person who has ten minutes.
| Hosting | Amazon Web Services, Frankfurt (eu-central-1), Germany |
| Data residency | EU only. Production in Frankfurt, backup copies in AWS Ireland (eu-west-1) |
| Encryption at rest | AES-256 on the database, file storage and backups. Keys in AWS KMS |
| Encryption in transit | TLS on every connection, including our API and our subprocessor connections |
| Database | Amazon Aurora MySQL, encrypted, deployed across two availability zones with automatic failover |
| Backups | Continuous point-in-time recovery to any second in the retention window, plus daily snapshots copied to a second EU region |
| Tenant separation | Enforced in the data access layer on every query path |
| Authentication | Password policy, optional multi-factor authentication, SSO via Google, Microsoft, Apple and LinkedIn |
| Authorization | Role-based, granular per feature area, configured by your administrators |
| Audit logging | Application audit trail, plus AWS CloudTrail across all regions with log file validation |
| Edge protection | AWS WAF (rate-based rules) on the production API, AWS Shield Standard for volumetric attacks. Injection and cross-site scripting defences sit in the application layer |
| Payments | Stripe (PCI DSS Level 1). Card data never touches an Orgo server |
| AI | Your member records are not sent to a model provider. See the AI section below |
| Certification | ISO/IEC 27001 preparation underway. We do not claim certification and publish no target date |
| Reportable breaches | None to date |
| Contract | Terms of Service · DPA · AI Addendum |
| Contacts | security@orgo.space · privacy@orgo.space |
Orgo is a white-label platform for membership organizations: associations, federations, political parties, faith-based organizations, scouting and youth movements, professional bodies and NGOs. Organizations on Orgo run from a few hundred to several thousand member accounts each, often across multiple chapters.
That shapes the security posture in a way a generic SaaS assessment will miss.
Your membership list is special-category data, and we designed for that. Under GDPR Article 9, political opinion and religious or philosophical belief are special categories. For a party or a church, that is not an edge case buried in a custom field — it is the membership list itself. We do not prohibit this data or push it into a workaround. The contract handles it directly: Terms of Service §7.11 sets out what you decide as controller and what we do as processor.
Some of you hold children's data, and most of you do not. Scouting and educational organizations process data about minors. Rather than letting that colour every clause of every document, it lives in one place: Annex 5 — Children's Data. The digital age of consent varies between 13 and 16 across EU member states, and Orgo applies the strictest applicable threshold for each jurisdiction. Our position on child sexual abuse and exploitation — what is prohibited, and how to report it — is stated separately in our Child Safety Standards.
Your members did not choose us — you did. They joined your organization. That is why member-facing content is never used to train anything, never mined for our own purposes, and never sent to an AI provider. See below.
eu-central-1), Germany. No transfers outside the EU
for core services.eu-west-1), so
that the loss of a single AWS region does not take your data with it. Both regions are inside the EU.app.orgo.space resolves directly to our AWS infrastructure. Application traffic is not proxied through
any third-party network. Our marketing site — the one you are reading — sits behind Cloudflare; your
application does not.Full detail on transfers and safeguards: Annex 4 — Standard Contractual Clauses.
Data is encrypted at rest with AES-256 — the database, uploaded files and every backup. Encryption keys are held in AWS Key Management Service, separately from the data they protect. Data in transit is encrypted with TLS, on every connection: your browser, the mobile apps, the public API, and the links between our systems and our subprocessors. Passwords are hashed, not encrypted, so they cannot be reversed even by us.
Your administrators control access inside your organization. Orgo staff access is a separate question, and the honest answer matters more than a reassuring one.
The full control set is in Annex 2 — Security Measures, which is part of the contract rather than a marketing document, and which states its own limitations expressly.
Orgo is multi-tenant: your organization's data sits in shared infrastructure, separated logically rather than by giving each customer their own database. Separation is enforced in the data access layer on every query path, and cross-organization access is blocked at the persistence layer.
This is the control a multi-tenant platform most needs to be able to evidence, so we do not ask you to take it on faith. Annex 2 §5.1 states how the boundary is enforced, as part of the contract rather than as marketing. Its test coverage, our verification roadmap and the evidence behind both go to your security team under NDA — write to security@orgo.space and ask.
We deliberately do not publish the current state of our test coverage, and we would be wary of a vendor who did. A public page describing where a boundary is not yet independently verified is a starting point for someone looking for a way in. Your auditors get the detail; a crawler does not.
Protection against the common web attacks is built into the application rather than bolted onto the edge: parameterized queries against SQL injection, output encoding and content security policy against cross-site scripting, CSRF tokens on state-changing operations, and session handling with secure, HTTP-only cookies and automatic timeout. Dependencies are scanned automatically for known vulnerabilities. At the edge, an AWS WAF web ACL applies rate limiting per API token and per source address on the production API, and AWS Shield Standard absorbs volumetric attacks.
The scope of each of these — including where the WAF stops and the application takes over — is set out in Annex 2 §5.4 and §7.
Membership organizations have deadlines that do not move: a congress, an election, a renewal window, a registration deadline. Availability is a feature.
Recovery objectives, the scenarios behind them and what evidence we hold are in Annex 2 §12 and §13.
This is the part most platforms describe vaguely. Ours is specific, because the architecture allows it.
Ask Orgo turns a question written in plain language into a database query. What is sent to our model provider is the text of the question and the structure of the database — table and field names. The query itself is compiled and executed inside our Frankfurt infrastructure, and the results never leave it.
No member record, no name, no email address and no membership data is drawn from your database and sent to a model provider.
One exception, and it is yours to control. If an administrator pastes an image into the chat — a screenshot of an old report, say — that image is sent to the model provider along with the question, because the model has to see it to answer. Whatever is visible in that screenshot goes with it. We cannot inspect an attached image before it is transmitted, so the decision of what to attach rests with your administrator.
No AI feature processes member-written content. Discussion posts, comments and direct messages are never sent to a model provider. Should we introduce moderation assistance, it will run on a model hosted inside our own Frankfurt infrastructure.
Our model provider is Anthropic PBC. Anthropic does not train its models on data submitted through its commercial API.
Our support assistant answers questions about configuring Orgo, drawing on our published product documentation. It receives your name, email address and organisation name, together with the question you write. It has no access to your Orgo database and performs no analysis on your members' data. You can ask for a person at any time.
Everything above describes data staying put. The MCP server is the one feature where your records deliberately leave us — because that is what you are asking it to do. It lets you connect an AI assistant of your own choosing to your Orgo data, so the assistant can read your records and, if you grant write access, change them.
We are not the ones choosing that assistant, and we say so plainly rather than implying we have vetted it:
Terms governing AI features: AI Addendum — Section 2b covers the MCP server specifically.
Inherited from our infrastructure providers, with certificates on file:
| Provider | Certifications |
|---|---|
| Amazon Web Services | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II |
| Stripe | PCI DSS Level 1 |
| Cloudflare | ISO/IEC 27001, SOC 2 Type II |
| Anthropic | ISO/IEC 27001, SOC 2 Type II |
In progress at Orgo:
We do not publish target dates for certification. A date on this page becomes an expectation a customer can rely on, and we would rather state what is true today.
If your procurement process requires a certificate today, here is the honest position. Orgo does not hold one. What we can put in front of you instead: the ISO/IEC 27001 and SOC 2 Type II attestations of the infrastructure our platform runs on, a security annex that is part of your contract and states the scope of each control precisely rather than overclaiming, and — under NDA — our internal audit findings, our risk register extract and our Statement of Applicability. Several organizations have completed their assessment on that basis. If yours cannot, tell us early and we will say so plainly rather than waste your evaluation cycle.
Orgo is a processor for the member data your organization manages, and a controller for administrator accounts, billing and our own marketing. The distinction, and what each party is responsible for, is set out in the Data Processing Agreement.
Most data protection failures on a platform like this happen in the gap between the two columns. So here is the split, in plain terms.
| You decide | We do |
|---|---|
| Why you collect member data, and on what lawful basis | Process it only on your documented instructions |
| What fields exist, and how long records are kept | Provide the retention, export and deletion mechanisms |
| Who in your organization gets administrator rights | Enforce the permissions your administrators configure |
| Whether to enable third-party pixels and integrations | Tell you, in advance, who our subprocessors are |
| Answering your members' GDPR requests | Give you the tools and assistance to answer them |
| Whether to collect data about minors, and how you obtain consent | Provide the safeguarding controls in Annex 5 |
A platform that is hard to leave is a platform you should be nervous about joining.
If we ever have to change one of the first two statements, we will change it here and tell customers directly.
| Region | Position |
|---|---|
| EU / EEA | GDPR compliant. EU data residency. Supervisory authority: ANSPDCP, Romania |
| United Kingdom | UK GDPR. No UK establishment; a UK representative is not required under Art. 27 |
| United States | We honour CCPA/CPRA rights, and equivalent rights under the Colorado, Connecticut, Virginia and Utah statutes, where they apply. Orgo does not sell or share personal data as the CCPA defines those terms |
Is my organization's data mixed with other customers' data? It shares infrastructure and is separated logically, enforced in the data access layer on every query path. Annex 2 §5.1 states how it is enforced; test coverage and verification evidence go to your security team under NDA. If you need physical separation, tell us during evaluation rather than after.
Can Orgo staff read our members' data? Technically, a small number of named administrators can, because someone has to be able to operate and repair the platform. Access requires multi-factor authentication, follows least privilege, is reviewed on a quarterly cycle running from August 2026, and administrative activity is logged. Nobody at Orgo browses customer data casually, and the contract prohibits processing outside your instructions.
What happens if AWS Frankfurt goes down? The platform runs across two availability zones and fails over automatically between them, which covers the common case. For the loss of the whole region, daily backups are held in a second EU region and recovery is a documented procedure with a stated objective. See Annex 2 §12.
Do you have a SOC 2 report? No, and we will not imply otherwise. See the certifications section above for what we provide instead.
Has Orgo been penetration tested by an independent third party? Not yet. A programme is in preparation and we publish no target date, because a date on this page becomes a promise. Current application security rests on secure development practice, automated dependency and vulnerability scanning, and the edge controls described above. Annex 2 §16.2 states this in the contract itself.
Will you sign our DPA instead of yours? Our DPA is already Article 28 compliant with SCCs annexed, and is the fastest route. If your legal team requires your own paper, a signed Order Form can vary specific terms under Terms of Service §14.1.2.
Who do we call at 2am? Security reports go to security@orgo.space and reach the responsible administrator directly — there is no ticket queue in between. Automated alerting on our infrastructure runs continuously; alerts are reviewed during business hours. We state this rather than implying a staffed 24/7 operations centre we do not run. Annex 2 §10.1 sets out the monitoring scope and its limits.
Can we audit you? Yes, on the terms in DPA Section 12. Most organizations find the security questionnaire and the NDA pack sufficient.
We answer security questionnaires — CAIQ, SIG, or your own spreadsheet. Send it to privacy@orgo.space.
On request we can provide our security policies in redacted form, our subprocessors' current certificates, and the completed PCI DSS self-assessment for our payment flow. Under NDA we go further: control-by-control maturity, our internal audit findings and their remediation status, and a Statement of Applicability extract. Write to security@orgo.space — the route is set out in Terms of Service §14.1.3.
security@orgo.space — responsible disclosure is welcome. Orgo will not pursue legal action against a researcher who reports a finding to us in good faith and who, while testing:
Orgo does not operate a paid bug bounty programme.
privacy@orgo.space — data protection questions, data subject requests, and completed security questionnaires for your procurement team.
This page describes Orgo's security posture as at the date below, and is provided for information. It is not a contractual commitment and does not vary the Terms of Service, the DPA or its annexes. Orgo's binding security obligations are those stated in Annex 2 — Security Measures; where this page and a contractual document differ, the contractual document governs.
Company: S.C. ORGO INFORMATICS SRL · J29/2796/2019 · CIF RO41650396 Str. Gheorghe Grigore Cantacuzino nr 14, Ploiești, Prahova, Romania
Last reviewed: August 1, 2026. This page is reviewed quarterly.