Security

A short, factual description of how Ordexly is built and what it stores. We don't hold any security certifications (such as SOC 2 or ISO 27001), and we don't claim to. Questions: hello@ordexly.com.

Hosting

Ordexly runs on Cloudflare Workers, and its data is stored in Cloudflare’s managed database. The site and app are served only over HTTPS.

Payments

Checkout and the billing portal are hosted by Stripe. Card details are entered on Stripe’s pages and never reach Ordexly’s servers. We store only Stripe references (customer and subscription IDs), your plan and its status, never card numbers.

Sign-in

• No passwords. You sign in with a one-time email link that expires after 30 minutes and works once.
• Only a hash of each sign-in link is stored, not the link itself.
• Your session is an HttpOnly, Secure, SameSite cookie that lasts up to 30 days.
• Sign-in requests, contact forms and similar endpoints are rate-limited.

Calendar feeds and client links

Each calendar feed uses a long random token in its URL. Anyone who has that URL can read that calendar, so share it only with the people who need it. Client portal links (Client Alerts add-on) are read-only, and you can revoke them. Ordexly stores only a hash of each portal link.

What we store

Your email, firm name and sign-in sessions; for each client entity, its name, states, entity type, formation details and reminder settings (and the client’s email if you enter it); billing references from Stripe; and a record of when you accepted the Terms. We don’t ask for SSNs, bank accounts or ID documents. Full details: Privacy & data.

Who processes data for us

Cloudflare (hosting and database), Stripe (payments) and Resend (sign-in and reminder emails). We don’t sell data, and we don’t use your data to train AI models.

Reporting a problem

If you think you’ve found a security issue, email hello@ordexly.com. If a breach affects your data, we’ll tell you without unreasonable delay.