Human approval by default
AI can organize and draft. Customer-facing messages, bookings, and charges require an authorized person.
SECURITY APPROACH
Trust is a product requirement.
ORPA CLOUD is being designed around explicit permission, human approval, and the minimum data needed to do the work.
Minimum necessary access
The Gmail release will request only the scopes required for features that are actually available.
Server-side credentials
OAuth tokens and payment secrets belong on secured servers, never in the browser or public source code.
Data minimization
The production system will avoid retaining full mailbox content when structured job details are enough.
Verified events
Payment and email events will be verified, replay-safe, and recorded for troubleshooting and accountability.
ORPA CLOUD is currently an early-stage product. We do not claim SOC 2 certification or other audits that have not been completed. Real Gmail and Stripe features will not launch until their authorization, privacy, and webhook controls are in place.