What runs where, and what agents can't do.

Your data

Orbizz is self-hosted. Your documents, drafts, published snapshots, analytics and agent logs live in your own database on your own infrastructure. Nothing is sent to Orbizz or to any model provider by the product itself.

Tenancy

Every organisation is its own tenant. Published docs are served per organisation at its own subdomain; the admin is on the apex with the organisation in the path. Every query that reads or writes tenant data takes the organisation as a required argument — a request for one organisation cannot resolve another’s content, and an unknown host never falls back to a tenant.

What agents can do

• Read published content only. Drafts and hidden versions are never served over MCP, Markdown, llms.txt or search.
• Report a gap: a question your docs did not answer. This writes a record to your queue and nothing else.
• Propose a fix: a verbatim replacement with evidence. It is stored as a pending proposal and never changes a page until a signed-in owner or member approves it. You can turn agent write-back off per organisation, and there is a cap on pending proposals so a misbehaving client cannot flood you.

Sign-in

Writers sign in with Google through Firebase Authentication. Access to an organisation requires a membership; a signed-in account with no membership is treated the same as a stranger.

Responsible disclosure

If you find a vulnerability, email security@orbizz.in. We will acknowledge within two working days and keep you informed until it is fixed. Please do not test against organisations you do not own.