Legal

Data Policy

Last updated: June 10, 2026

1. Scope of This Policy

This Data Policy describes how Orilium handles the data your organization processes through the Platform — including workflow definitions, actor and permission mappings, policy documents, and the events Codex evaluates against them.

2. Data Ownership

Your organization retains full ownership of all data you upload or generate on the Platform. Orilium acts as a processor of this data on your behalf and only uses it to provide and improve the governance services you have enabled.

3. Data Classification & Sensitivity

Data processed by the Platform is classified by sensitivity and handled according to its classification. Crown-jewel actions and high harm-tier operations receive additional safeguards, including stricter access controls and audit logging.

4. Data Residency & Storage

Your data is stored in secure, access-controlled environments. Where regional data-residency requirements apply, we store and process data in accordance with the applicable jurisdiction configured for your organization.

5. Data Retention

We retain your data for as long as your organization maintains an active account, and for any additional period required to comply with legal, regulatory, or contractual obligations. You may request export or deletion of your data at any time.

6. Third-Party Processing

Certain features rely on trusted sub-processors (for example, payment processing and infrastructure hosting). These parties are contractually bound to protect your data and may only use it to deliver the services we have engaged them for.

7. Access Controls & Audit

Access to organizational data is governed by role-based access controls and the enforcement structure you configure during CDS setup. Administrative and enforcement actions are recorded to support audit and compliance reviews.

8. Contact

For questions about how your data is handled, or to exercise your data rights, contact us at data@orilium.com.