EU hosting, single sign-on and security by default

Before an organisation trusts a platform with its website and its people, it needs straight answers. Where is our data? Who can get in? What happens when something goes wrong? This post answers those questions for Bifröst Orbit and CMS Orbit, and points to the documents that back them up.

Where your data lives

Bifröst Orbit is hosted in the EU:

• The platform and its database: Servers run by IONOS in a data centre in Spain.
• Files and backups: Stored with Amazon Web Services in Ireland.
• Email: Sign-in codes, invitations and notifications are sent from Ireland through Resend.
• Machine translation: DeepL in Germany, only when someone asks for a translation.
• Single sign-on: Microsoft in Ireland, only for organisations that connect their own Entra tenant.

Two providers sit outside the EU, and we'd rather say so plainly. Cloudflare, our network provider, routes traffic through its worldwide network to deliver pages and protect them from attacks. Slack is where our team reads and answers support chat messages. Both are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. The sub-processors page names every provider, what they do and where.

Who can get in

No passwords to leak

There are no Bifröst Orbit passwords. People sign in with a six-digit code sent by email, which works once and expires after 10 minutes, or with your organisation's single sign-on. A session lasts up to 8 hours.

Single sign-on you control

Connect your own Microsoft Entra ID app, so nothing about your tenant is stored anywhere but your organisation's sign-in settings. Require SSO for your email domains, and everyone with an address there must use it: nobody can get round it with an email code. Access can follow your Microsoft app roles, so taking a role away in Microsoft removes the access at the next sign-in. Organisations on Google Workspace can turn on Google sign-in for their domains instead, and personal Google accounts are always refused. See connect Microsoft SSO and connect Google SSO.

Access decided in one place

Orbit decides who belongs to your organisation and which satellites each person can open. Remove someone once and they lose access to every product straight away, including any roles they had inside them.

Roles and permissions

CMS Orbit has built-in roles, custom roles on Growth and Enterprise, and access that can be limited to regions. Every permission is checked on the server for every request. Every record carries its organisation, and data is always read and written within it.

Keys and integrations

• Secret keys stay secret: The SDKs refuse a secret key in browser code and in iOS and Android apps.
• Drafts stay private: Keys for the live website can't read drafts, and preview keys only work against Staging.
• Signed webhooks: Webhook messages are signed, and the SDK's handler rejects messages more than five minutes old.
• Staging stays out of search: Only Production can appear in search results.

A record of every change

Every change, approval and setting in CMS Orbit is recorded with who, when and what, including AI agents and the person they acted for. AI agents never have more rights than the person behind them, and a person approves every page change they draft.

When something goes wrong

• Backups: Nightly, kept for 14 days in a versioned, encrypted storage bucket.
• Encryption: Connections use TLS, and secrets such as sign-in credentials are stored encrypted.
• Mistakes you can undo: Deleting moves things to the bin, and by default only the Owner can erase for good. Deleting a whole organisation has to be confirmed in Orbit first.
• Status you can see: Anyone can follow the platform's health, 30 days of uptime and recent incidents at docs.bifrostorbit.com/status.

No system is perfectly secure, and we don't claim otherwise. We work to keep the risk low, and we'll tell those affected about a breach as the law requires.

Your data stays yours

The service has no analytics or advertising tracking, and our website uses no analytics, advertising or tracking cookies. You can download a whole website at any time as one JSON file, and every entry is available as structured JSON through the APIs.

The documents behind this post

• Privacy policy: what we collect, why, how long we keep it and your rights
• Data processing agreement: our agreement under Art. 28 GDPR, with the measures we take
• Sub-processors: every provider, what they do and where
• Cookie notice: the few cookies there are, and why

Read the security overview, or ask us what your organisation needs to know. A person on our team will answer.