Compliance & security
Compliance built into the code, not a policy PDF
Orchestrun is built with privacy-first, regulation-native architecture from the very beginning. Consent, audit, and access controls are enforced at the API layer and proven by dedicated automated test suites — not retrofitted after the fact.
Consent & privacy
Consent Engine — check, record, and bulk-check consent, keyed by user, email, or phone.
DSAR automation for access, erasure, and export — a real cascading erasure that reaches contact lists, CRM contacts, enriched profiles, journey runs, and conversion events, tenant-scoped so one tenant's request can never touch another's data.
Suppression lists — hard/soft bounce, spam complaint, and unsubscribe tracked independently of consent, checked before every send.
Privacy notice templates for GDPR, CCPA, and PDPA.
CAN-SPAM (auto-injected, signed unsubscribe links) and TCPA (quiet-hours, STOP/START) automation built into email and SMS.
Audit & governance
Full audit logging on privacy-relevant actions, writes, approvals, SSO/SCIM provisioning, subprocessor decisions, and autonomous-approval decisions — each entry for an autonomous decision carries the full reasoning behind it.
Org → Account → Campaign settings cascade with compliance-lock enforcement — child scopes can only tighten inherited restrictions, never loosen them, enforced at write-time.
Configurable data-governance rule engine — validation, enforcement severities, dedup and merge tooling.
Access Review Report — a single PDF snapshot of JIT grants, subprocessor approvals, IP allowlist rules, and field-access policies for compliance audits.
PII protection
Field-level PII masking — phone/email/address/DOB masked by default for everyone except the record's Account Owner, with no exceptions, not even Platform Admin.
Field-level redaction on AI agent tool-call results before content ever reaches the LLM — admins can block specific fields from entering agent context.
AES-256-GCM encryption for stored integration credentials, with a pluggable key-provider abstraction built for bring-your-own-key.
Identity & enterprise security
SAML/OIDC SSO with self-serve domain-ownership verification — no platform-admin step required.
SCIM 2.0 user and group provisioning, with a full atomic deprovisioning cascade.
Tenant IP allowlisting (CIDR, IPv4 + IPv6) with a mandatorily-audited break-glass bypass.
Just-in-time access grants — both customer-facing and for Orchestrun's own internal staff, ticket-gated and auto-expiring.
Subprocessor transparency — a catalog of every third-party subprocessor with admin approve/block control.
Fine-grained RBAC with 66+ per-channel permission keys and a full role-builder, plus a plan-based entitlements engine checked before every protected route.
Built for global regulation
Orchestrun’s compliance architecture is designed around GDPR, CCPA/CPRA, and the emerging EU AI Act obligations around automated decision-making — including a real profiling-consent gate that requires explicit human approval before behavioral or enriched data can be used for targeting. Data-residency controls and formal third-party certifications are on our active roadmap; we’ll always tell you plainly what’s shipped versus in progress.