Security
A summary for IT, security and procurement teams: what crosses the network, the controls in the app, and the services we rely on.
Data flow
OrcStat never receives the data you analyse. These are the only things that cross the network.
The engine runs on your computer, or inside your browser for the browser version.
Exports are files you save and share yourself.
Local Only mode blocks every other destination. Exposure levels decide what a model may see.
The app does not report what you do in it.
Licence ID, a hashed device ID, app version and operating system. About once a day, and the app works offline for up to 30 days.
Name, email, plan, seats, roles and registered devices.
Card details go to Paddle and never reach OrcStat.
In the app
Every control works offline and can be enforced for every seat with one admin policy file.
Local Only egress guard. AI requests are pinned to approved hosts. DNS, redirects, IPv6 and IPv4-mapped addresses are re-checked, and blocked attempts are logged.
Exposure levels 0–3. Projects choose how much an AI model may see, from variable metadata only to full data, with a preview of every request.
Encryption at rest. AES-256-GCM project files with scrypt-derived keys, encrypted autosave and recovery, and SPSS-compatible password-protected .sav.
Secrets in the keychain. API keys and passwords are stored by the operating system, never in project files or logs. Passwords are redacted from the journal.
Audit log. Each AI request records what was shared and what was approved. Export it for governance, or purge it.
Signed extensions. Extension packages are hash-checked and Ed25519-signed. An admin policy can refuse unsigned packages entirely.
AI requests
The AI helps plan and explain an analysis. It never sees more than you allow, and it never computes a number.
The project's exposure level decides what goes into the request. By default that's variable names, labels and output tables, never the rows of your data.
Every request can be shown before it's sent, with exactly what the model will see.
Local Only mode lets the request reach only approved model servers on your machine or network. DNS answers and redirects are re-checked, and blocked attempts are logged.
The model writes words. Every statistic comes from the validated engine, and every number in the AI's text is checked against the engine's output before you read it.
The audit log keeps what was shared and what you approved, for export or purging.
More detail is in the privacy policy.
No. Datasets, projects, output and reports stay on your computer, or inside your browser for the browser version. Our servers only hold your account, plan, devices and billing.
Only to model servers you configure. Local Only mode is on by default and blocks every other destination. Cloud models (OpenAI, Anthropic or Google) are off by default: they work only with your own API key, after you turn them on for a project, and an admin policy can forbid them entirely.
Exactly four things: the licence ID, a hashed device ID, the app version and the operating system. The device ID is a one-way hash of a random ID created at install, so it says nothing about your computer.
Everything keeps working. The app needs to check its licence once every 30 days; after that it switches to read-only mode until it can check again. Your projects stay yours to open, view and export.
Yes. One admin policy file locks the model endpoint, keeps AI on your network, decides whether cloud models are allowed and how much they may see, and turns off AI features you don't want. The policy always wins over user settings.
Subprocessors
These providers handle account and billing data only. None of them ever sees the data you analyse.
Security reviews