Skip to content

Free trials of CMS Orbit open in

Security and trust

Your content, under your control.

Bifröst Orbit is built for organisations that answer for what they publish. Access is managed in one place, every change in CMS Orbit is recorded, and your content is hosted in the EU.

The essentials

Security is part of the platform, not an add-on

EU hosting

The platform runs in a data centre in Spain, and files are stored and email is sent in Ireland. Our network provider may route traffic outside the EU under standard safeguards.

Single sign-on

Connect your own Microsoft Entra ID app or turn on Google Workspace sign-in, and require it for everyone on your email domains.

Access in one place

Orbit decides who belongs to your organisation. Remove someone once and they lose access to every product.

Roles and permissions

Built-in roles, custom roles on Growth and above, and access that can be limited to regions. Every permission is checked on the server.

Audit trail

Who changed what in CMS Orbit, when and on whose behalf, including AI agents.

Keys that stay secret

Secret keys are rejected in browser code, production keys can't read drafts and webhook messages are signed.

Deletion

Mistakes you can undo

Deleting a page, file or website moves it to the bin, where it can be restored. By default, only the Owner can erase anything for good, and deleting a whole organisation has to be confirmed in Orbit before anything is erased.

AI agents

Agents work inside your rules

An agent acts for one person and never has more rights than they do. It can't publish, change protected prices or settings, or read the audit trail, and every page change it makes needs a person's approval.

Data protection

Sub-processors and data protection

We use a few trusted providers to run the service, for hosting, email delivery and file storage. Everything they do for us is written down.

Sub-processors

Every provider, what they do for us and where they process data.

Privacy policy

What we collect, why, how long we keep it and your rights.

Data processing agreement

Our agreement under Art. 28 GDPR, with the measures we take.

From the blog

More about security

All posts
CMS Orbit

4 min read

Reviews, approvals and an audit trail, built in

How CMS Orbit keeps content right: reviews on every plan, approval steps and review dates on Growth, approved claims, emergency publishing and a record of every change.

Questions about security?

Tell us what your organisation needs to know and we'll answer it.

Talk to us