Security & privacy
ORQVION Online Beta is a desktop IDE with AUTO routing (online default, offline ORQVION AI + GGUF on your machine). Agent actions are permissioned, sandboxed, and auditable. The license server resolves entitlements — it is not a prompt archive or coding cloud. Website analytics and desktop telemetry stay off until you opt in.
Project source, indexes, chat history, and credentials stay on your devices. ORQVION does not permanently store your tree or conversations on marketing or license infrastructure. Enterprise audit carries structured metadata — not file contents.
AUTO tries online entitlement/BYOK paths first; OFFLINE runs ORQVION AI + local GGUF via llama.cpp (not the Ollama app). Org policy can gate BYOK, external providers, and offline models. Inference to a cloud API only when your mode and keys send it there — not through the license server as a proxy.
Writes require approval. Docker container sandbox can be required by org policy. Ask mode cannot write or shell. Tools are scoped by permission, role, and MCP allowlists.
Least privilege, no secrets in logs, signed entitlement tokens (Ed25519), and secret scanning hooks before diffs apply on the enterprise path.
OIDC, SAML 2.0, and LDAP/AD for organisations — desktop sessions refresh against your IdP. Structured JSON audit events sync to your enterprise server; prompts and source are not the payload.
Marketplace packages are signed. Runtime is sandboxed (WASM). Unsigned or policy-blocked packages do not run.
Data boundary
| Data | Default location | Leaves the device? |
|---|---|---|
| Source, assets, Git | Your project directory | No — unless you push to a remote you configured |
| Chat history | Local ORQVION storage | No — history stays on the machine unless you export or sync via an explicit action |
| Online inference (AUTO / ONLINE) | Desktop → configured provider APIs | Yes — request/response payloads go to the provider you (or org policy) enabled; BYOK keys stay in the OS keychain |
| Offline inference (OFFLINE / AUTO fallback) | ORQVION AI + GGUF on device (llama.cpp) | No — weights and tokens stay local once downloaded |
| Credentials (BYOK, SSO) | OS keychain + your IdP | Never through ORQVION as plaintext; providers receive only what their API requires |
| Indexes / symbols | Local app data (Tantivy + Tree-sitter) | No |
| License / activation | Your license server or public entitlement API | Entitlement, device binding, and identity metadata only — not prompts, repo paths, or file contents |
| Website analytics | Opt-in cookie + provider | Only after you allow analytics on orqvion.com |
Desktop telemetry, crash reporting, and usage analytics default to off. Online Beta defaults to AUTO online routing; add BYOK under Settings or switch to OFFLINE for local GGUF. Agent shell and network access stay gated by approvals and org policy.
The license server (self-hosted or ORQVION public API) honours seats and plan matrix rules — it does not relay chat or index your codebase. Usage metering where enabled stores counts and metadata, not prompt or response bodies.
This marketing site loads analytics only after opt-in; the banner is not pre-checked. Checkout is noindex. For DPAs, on-prem/air-gap designs, and threat-model reviews, contact sales — the public Privacy Policy is the product-accurate baseline.
