Security and compliance
If your Salesforce org complies, Orchestrator does too.
Ortoo Orchestrator runs entirely inside Salesforce. No Ortoo-hosted infrastructure, no copy of your data, and a much smaller review scope.
In short
Is Ortoo Orchestrator secure and compliant?
Ortoo Orchestrator is a 100% Salesforce-native managed package. Its logic, configuration and data all reside in your Salesforce org, under the permissions, authentication, audit trail and compliance controls you already run. Ortoo does not store or process your data on its own systems. Data leaves Salesforce only through external services you choose to connect, such as an LLM provider you contract with directly. Orchestrator can also run with no AI and no external connections at all.
Architecture
Your org, your controls, your contracts
Fully native
Installed as a managed package inside your org. No Ortoo-hosted data store, no external runtime, no sync out. Passed Salesforce's AppExchange security review.
Your controls, inherited
Same data residency, SSO and MFA, permissions, sharing rules and audit trail. Data in Salesforce stays under Salesforce's compliance programme, including SOC 2 Type 2 and ISO 27001.
AI on your terms
Deterministic automation runs with no AI and no external connection. Where AI helps, you connect the provider and hold the contract, including the residency and retention terms. Ortoo is not a party to it.
Security and compliance, quick answers
Does any of our data leave Salesforce?
Only if you configure it to. Orchestrator runs inside your org, and Ortoo never extracts or stores your data. Data leaves Salesforce only through external services you connect, such as an LLM provider, a vector store, an external API or an MCP server. It goes only to the services you chose, under your agreements with them. Ortoo does not sit between your org and those services, and has no visibility into them.
Do we need an external AI provider?
No. Routing, record handling and deterministic automation run entirely inside Salesforce, with no AI and no external connection. When you do use AI, you choose the provider: OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, or a model on your own infrastructure. Your API credentials are stored in your Salesforce org and are not accessible to Ortoo. All traffic uses HTTPS/TLS.
We work in a regulated industry. How does Orchestrator fit our compliance programme?
Orchestrator adds no new place for your data to live. Data in Salesforce stays under the controls, residency and audit trail your compliance programme already covers, with residency following your Salesforce data centre. If you connect an external service, such as an LLM provider, what you send it is governed by your agreement with that provider. Check its residency, retention and regulatory terms as you would for any vendor.
Does Ortoo have SOC 2 or ISO 27001 certification?
As at October 2026, Ortoo holds no external ISO 27001 certificate or SOC 2 report. Your data does not depend on one, because it never sits on Ortoo infrastructure. It stays in Salesforce, covered by Salesforce's SOC 2 Type 2 and ISO 27001 certifications. Orchestrator has passed Salesforce's AppExchange security review. Ortoo also runs an information security programme structured on ISO 27001, with annual internal audits, a secure development lifecycle, and incident response and breach notification procedures.
Can Ortoo see our records?
No, not in normal operation. Through Salesforce's partner framework, Ortoo can manage licences, see which version you run and push upgrades. Nothing more. If you want help with an issue, you can grant support access. You decide its scope and remove it once the issue is resolved, and every action shows in Salesforce's audit trail.
Who is responsible for what?
Salesforce secures the infrastructure and runs its compliance programme. You control users, access, data residency and any external services you connect. Ortoo is responsible for the security of the Orchestrator code, its development lifecycle, updates and support.
Running a security review?
Get the full architecture and security document, written for security and architecture teams.
Questions: security@ortooapps.com
Wondering about cost? See how pricing works