Security
How OrdoVia handles company data.
OrdoVia uses Supabase for its database, authentication, and storage, with Cloudflare supporting the web application. Access within OrdoVia is controlled according to the company, user, and work the user has been given access to.
Infrastructure
Built on Supabase and Cloudflare.
OrdoVia uses Supabase for its PostgreSQL database, authentication, and file storage. Access policies are used to control which records authenticated users can reach.
Cloudflare sits in front of the web application and provides encrypted web traffic and protection against common network attacks.
The OrdoVia web application is served over HTTPS.
Isolation
Company records are separated by account.
OrdoVia uses PostgreSQL row-level security policies to separate company records. Authenticated users are matched to the company and records they are authorized to use before data is returned from the database.
The same approach is used to restrict access within a company where a user has been given access to only part of the operation.
Access
Not everyone needs to see the whole company.
Access can be limited according to the work a person is involved in.
A team member may work within one area of the business. A contractor may be assigned to a single project. A vendor or client may only need the information made available through their portal.
The owner or CEO can retain a broader view across the company without giving every user the same access.
Integrations
Connected services stay with the company.
Supported integrations can use the company’s own accounts and credentials rather than a shared OrdoVia account.
This may include electronic signature, email, fax, AI services, and other supported integrations. A company can disconnect an outside service without affecting another client’s OrdoVia setup.
Support
Support access is limited to the work required.
OrdoVia does not use client accounts as part of routine support. When access to a workspace is required for configuration, troubleshooting, or maintenance, it is limited to the work being performed.
Additional support-access terms are set out in the client agreement.
Data
The company’s information belongs to the company.
The company retains ownership of the information it enters into OrdoVia. Data export, retention, and account-close procedures are covered by the applicable client agreement.
Questions
Questions about security?
Access, data, and integration requirements can be discussed before an OrdoVia account is configured.