ZERO-TRAINING EPHEMERAL DOCUMENT AIRLOCK
Security, Tenant Isolation, 24h Ephemeral Purge & Subprocessors
OrderAirlock protects wholesale distributor pricing tables, customer part dictionaries, and inbound Purchase Orders with strict tenant boundaries.
Security Dossier · OrderAirlock Operations (
security@orderairlock.com · support@orderairlock.com)1. ZERO AI MODEL TRAINING
Your Customer POs & Contract Prices Never Train Models
Customer POs, Master Catalogs, and contract prices never train AI models. CSV and JSON webhooks run with zero LLM calls.
2. 24-HOUR EPHEMERAL PDF PURGE
Wipe Source PDFs While Preserving SHA-256 Audit Proof
Raw customer PDFs are purged 24 hours after ERP commit while retaining the immutable SHA-256 commit receipt hash.
3. STRICT TENANT ISOLATION & AES-256-GCM
Mandatory Workspace Scoping & Encrypted Signing Keys
100% of queries enforce workspace_id isolation (HTTP 403/404 on cross-tenant access) and AES-256-GCM key encryption.
4. OWASP CSV & SSRF DEFENSES
Formula-Injection Sanitization & Private-IP Blocking
ERP CSV cells neutralize =, +, -, @, \t, \r prefixes. Outbound HMAC-SHA256 webhooks block RFC 1918 and loopback IPs.
DATED SUBPROCESSOR REGISTER (LAST UPDATED: 2026-11-04)
Infrastructure & Payment Subprocessors
| Subprocessor | Purpose | Data Scope | Region & Retention |
|---|---|---|---|
| Polar Software, Inc. / Stripe, Inc. | B2B subscription billing ($249 / $499 plans) | Billing email, payment token, subscription status (zero PO line data) | US / EU · PCI-DSS Level 1 |
| Google Cloud Run / App Hosting | Isolated workspace datastore & ephemeral PO airlock | Encrypted workspace tables; raw PDFs purged after 24h window | US-Central · 24h PDF Purge |
| OpenAI (Optional Fallback Only) | Zero-data-retention raw string OCR fallback when enabled | Disabled for CSV/JSON; never used for SKU/UOM/price gate decisions | US · Zero Training Retention |
Vulnerability Disclosure & Security Contact
Inspect /.well-known/security.txt and report vulnerabilities to security@orderairlock.com.