Trust Center

How Oreana behaves when no one is watching.

This document describes the guarantees Oreana makes to everyone who trusts it with a life.

It is written as guarantees, not certifications. Where something is planned rather than in place, we say so plainly. We would rather tell you what is true than borrow trust we have not yet earned.

01Security

How Oreana protects your data.

  • All communication is encrypted.
  • All stored information is encrypted.
  • Every request is authenticated.
  • Every account is isolated.
  • Infrastructure is operated exclusively within Switzerland.

Oreana runs on infrastructure independently certified to SOC 2 Type II and ISO 27001. The certifications are the infrastructure's; the discipline of choosing it is Oreana's.

Technical implementation
Encryption in transit
Modern TLS.
Encryption at rest
AES-256.
Authentication
Verified on every request.
Isolation
Per-account, least-privilege access.
02Privacy

How Oreana treats your information.

Swiss data residency
Your data is stored in Switzerland, under Swiss law.
Data ownership
Your data belongs to you. Not to Oreana, and not to anyone we work with.
Retention
We keep only what serves you, for as long as it serves you.
Deletion
When you delete something, it is gone. Deletion is permanent, not hidden.
Portability
You can export everything Oreana holds, at any time.
03Reliability

How Oreana earns your confidence over time.

Live status
The current operational state of Oreana, updated continuously.
Incident history
Every incident, documented after the fact. Nothing quietly deleted.
Planned maintenance
Announced before it happens, never sprung on you.
Historical uptime
Published from real measurement — not promised in a marketing number.
04Architecture

How Oreana works.

Memory
Oreana holds your context so you never have to repeat it — and remembers only what you choose to keep.
Reasoning
Every signal passes through context, judgment, and timing before anything is done.
Approvals
Nothing that matters happens without your explicit approval.
The Trace
Every decision leaves a private, inspectable record — visible to you, hidden from everyone else.
Authorization
Oreana acts within the boundaries you set, and only within them.
05 — Responsible AI

The articles that govern every decision Oreana makes. Not boilerplate — the terms of the relationship.

  1. Article IOreana never acts without authorization.
  2. Article IIOreana remembers only what serves you.
  3. Article IIIOreana explains meaningful decisions.
  4. Article IVOreana leaves a private record.
  5. Article VOreana is accountable to you — not the other way around.
06Legal

The paperwork, kept separate from the principles.

Privacy PolicyRead
Terms of ServiceRead
Data Processing AgreementRead
SubprocessorsRead
07Institutional Commitments

What Oreana intends to establish, as it grows.

Published in advance — not certifications we claim, and not badges — so we can be held to them.

Independent security assessment
Responsible disclosure
Third-party audit
Continuous penetration testing

These are the standards Oreana holds itself to — especially when no one is watching.