Skip to main content

Security

WisdomX Orbis handles sensitive enterprise infrastructure data. This page explains how the platform protects that data and what controls are in place.

Security Architecture​

Orbis is a cloud-native platform built on Microsoft Azure, following a zero-trust security model. No user, system, or network is trusted by default. Every access request is verified before it is granted.

Authentication and Access​

All access is handled through Microsoft Entra ID (Azure Active Directory) using OAuth 2.0 with PKCE:

  • No passwords are stored in Orbis, as authentication is delegated entirely to Microsoft
  • Your existing Entra ID policies apply automatically: MFA, conditional access, and device compliance requirements are enforced without additional configuration
  • Single sign-on works immediately if your organisation uses Microsoft 365
  • Role-based access control is managed through your existing Entra ID user groups

The PKCE (Proof Key for Code Exchange) flow means no client secret is ever held in the browser, so authentication tokens cannot be intercepted and replayed.

Data Security​

  • In transit: all data is encrypted using TLS 1.3
  • At rest: all stored data is encrypted using AES-256
  • Secrets: no credentials, connection strings, or API keys are stored in application code. All secrets are held in Azure Key Vault, accessed at runtime via managed identity
  • Data isolation: each customer's data is logically isolated; your estate data is never accessible to other Orbis customers

Infrastructure Security​

  • Backend services run within a private Azure Virtual Network
  • The only public entry point is Azure API Management, which enforces authentication, rate limiting, and input validation on every request
  • Azure WAF and DDoS protection are active on the API gateway layer
  • All software dependencies are scanned for known vulnerabilities on every deployment
  • Regular third-party penetration testing, with results available to enterprise customers under NDA

Compliance and Documentation​

Security documentation including data processing agreements and completed security questionnaire responses are available on request. Email security@wisdomx.uk.

Reporting a Vulnerability​

If you discover a security vulnerability in WisdomX Orbis:

  • Email security@wisdomx.uk with a description and steps to reproduce
  • We will acknowledge within 48 hours and provide a resolution timeline
  • We operate a responsible disclosure policy: do not publish before contacting us
  • We will not take legal action against researchers who follow responsible disclosure guidelines