Security & AI governance
The page your security team goes looking for.
AI-vendor review is where enterprise deals stall. So this page answers it in public, before anyone has to ask: where the data lives, what Echo, Orca's Customer Intelligence Agent, reads, and what it does and does not do.
Echo · data access
READS · Named scoring signals
From your CRM and the sources you connect · 40+ signals pre-set out of the box
Entitlement · Product usage · Adoption depth · Account health · NPS · Support history · Tenure · Engagement recency · Reference fatigue · Format preference · Region · Persona · Industry · Prior outcomes · STORES
Records in your CRM
Under your sharing rules, territories and permissions
AI PROCESSING
Your model, bring one
Bring your own LLM and AI processing runs on your own model tenant
DETAILS · Reports, policies, subprocessors
Current and public at trust.orcaforce.co
TRUST CENTER · TRUST.ORCAFORCE.CO
SOC 2 Type II
Independent audit of security controls
Report in trust center
ISO/IEC 27001
Information security management system
In progress · ISO/IEC 42001
AI management systems: governance for the Echo layer
In progress
01 · DATA RESIDENCY
Where your data lives
Orca's CRM component runs inside your CRM. Advocates, requests, signals and activities are records there, governed by your existing sharing rules, territories and permissions. On Salesforce it installs as a managed package. Echo's call processing runs outside your CRM; the current subprocessor list is at trust.orcaforce.co.
02 · MODEL INPUTS
What Echo reads
Echo scores advocates on fourteen named signals, from entitlement and usage to fatigue and prior outcomes, read from your CRM and the sources you connect: call recordings, your CS platform, your data warehouse and email. It ships with 40+ signals pre-set; the full list is public on the Echo page. Every answer is grounded in retrieval: a match traces back to the records that produced it.
03 · MODEL TRAINING
Your data never trains a model
Orca does not use customer data to train models. Every plan runs on the LLM you bring, so AI processing stays on your own model tenant. Current policies and the subprocessor list live in the trust center at trust.orcaforce.co, and a data processing agreement is available.
04 · DOCUMENTATION
Certifications & documentation
Current compliance reports, policies and subprocessors are at trust.orcaforce.co. Orca completes independent third-party penetration testing and has cleared security and procurement reviews at large enterprise software companies. For anything specific to your review, we send documentation directly.
Review questions
The questions your reviewer will ask.
Answered here and in the trust center, before anyone has to ask.
What Echo reads
What data does the AI read?
Named scoring signals, from entitlement and usage to fatigue and prior outcomes, read from your CRM and the sources you connect: call recordings, your CS platform, your data warehouse and email. The full list is public on the Echo page.
Is it just summarizing calls?
No. Echo only acts on what a customer actually said, with the quote and timestamp attached. Every match traces back to the records that produced it.
Models & AI
Can we use our own model?
Yes. Every plan runs on the LLM you bring, so AI processing stays on your own model tenant.
Does Orca train models on our data?
No. Orca does not use customer data to train models.
Does Orca connect to our AI tools?
Yes. Orca offers an MCP connection for AI workspaces, under the same guardrails as the platform.
Reviews & documents
Where are the current reports?
In the trust center at trust.orcaforce.co, with current compliance reports and policies. For anything specific to your review, our team sends documentation directly.
Is there a DPA and a subprocessor list?
Yes. A data processing agreement is available, and the current subprocessor list is in the trust center.
Do you test independently?
Yes. Orca completes independent third-party penetration testing, and has cleared security and procurement reviews at large enterprise software companies.
Where do Orca's records live?
In your CRM. Advocates, requests, signals and activities are records there. On Salesforce, Orca installs as a managed package. Echo's call processing runs outside your CRM; the current subprocessor list is in the trust center.
Who can see advocate records?
The same people who can see the rest of your CRM data. Your existing sharing rules, territories and permissions apply from day one.
Bring your security team to the demo.
Bring the hard questions to week one.