Enterprise Security Overview
Orbis Studio is designed for on-premise deployment in enterprise environments. This page summarizes the security controls available to platform administrators.
Data residency and on-premise deployment
Orbis Studio runs entirely within your own infrastructure. No flow data, credentials, user inputs, or model outputs are transmitted to Orbislabs or any external service unless you explicitly connect an external provider (such as an LLM API or vector store).
On-premise deployment means:
- All data at rest is stored in your own database (PostgreSQL). You control the database host, credentials, and backup policy.
- All data in transit stays within your network perimeter. Orbis Studio communicates over HTTP/HTTPS on ports you configure.
- External AI model calls (OpenAI, Azure OpenAI, and similar) are made directly from your Orbis Studio backend to the provider — Orbislabs is not in the path.
When using a local (on-premises) model, data never leaves your infrastructure at any point. If the system has no internet access and no external services are configured in a flow, it operates in complete network isolation.
For deployment configuration, see Platform architecture.
PII masking and data protection
Orbis Studio includes a built-in Guardrail component for PII (Personally Identifiable Information) protection. When using a cloud-based LLM, sensitive fields such as national ID numbers (TCKN) and financial data can be masked before the data is sent to the model.
The flow works as follows:
- The Guardrail component intercepts the input and masks configured sensitive fields.
- The model processes the masked data.
- The Guardrail unmasks the response before returning it to the user.
This allows cloud models to be used without exposing sensitive personal data to external providers.
User access control (RBAC)
Orbis Studio supports role-based access control through its user management system.
User roles
| Role | Capabilities |
|---|---|
| Superuser | Full platform administration: manage users, projects, global variables, and API keys. Access all flows and resources. |
| Standard user | Create and run flows within their own projects. Cannot access other users' private resources or modify platform-wide settings. |
Configuring access
- Superuser account: A superuser account is created at deployment time by your Orbislabs installation team. The superuser can manage all users, projects, and platform-wide settings.
- Authentication enforcement: For production deployments, authentication is enforced by default — all users must log in before accessing the platform.
- User registration: Your Orbis Studio administrator controls whether users can self-register. When self-registration is disabled, new accounts require superuser activation before they can log in.
For API authentication details, see API keys and authentication.
SSO and identity provider integration
Orbis Studio supports integration with corporate identity providers for authentication:
| Protocol | Support |
|---|---|
| Active Directory (AD) | ✓ Supported |
| LDAP | ✓ Supported |
| OIDC | ✓ Supported |
Users can authenticate with their existing corporate credentials. Contact your Orbislabs account team for identity provider configuration.
For direct LDAP/AD configuration, account lifecycle behavior, and the recommended Keycloak federation profile, see Enterprise directory authentication.
Token usage and limits
Orbis Studio tracks input and output token consumption per user for every flow execution. Platform administrators can define per-user token limits to prevent unintended usage.
Metrics are stored in the PostgreSQL database and can be visualized in any compatible dashboard tool (Prometheus, Grafana, or similar). For observability setup, see Langfuse integration.
Audit logging
Every step of every agent execution is logged. Log retention periods are configurable based on your organization's requirements. Because the system runs on-premises, all log data remains within your infrastructure.
Logs are stored in the PostgreSQL database and accessible from the platform UI under Monitor. Log retention is configurable by your administrator.
API authentication
All programmatic access to Orbis Studio is authenticated via API keys. Keys are created per user and managed through the UI. See API keys and authentication.
Network and infrastructure security
For production deployments, enforce network-level isolation at the infrastructure level:
- Place Orbis Studio behind a reverse proxy (Nginx) with TLS termination.
- Expose only ports 443/80 to users.
- Limit management port access (Infisical
18080, Langfuse3002, PostgreSQL5433) to internal network or VPN only.
For the full port reference, see Platform architecture.