When a coach subscribes to ORCA or billing runs for a student group, the payment is handled entirely by Stripe. Stripe is a payments infrastructure company that has spent years on exactly this problem, and they have a depth of expertise that would take us years to match.

Stripe holds PCI DSS Level 1 certification, the highest tier for payment processors. Their systems go through independent audits every year to verify that card data is handled correctly.

ORCA never sees your full card number and never stores it. When you enter payment details, they go directly to Stripe's servers over an encrypted connection. What comes back to us is a reference token, not the card itself.

ORCA runs on Replit's cloud platform, which is built on top of Google Cloud. Physical infrastructure, network security, and server patching are all handled by teams whose only job is keeping production systems secure and available.

All traffic between your browser and ORCA is encrypted over HTTPS. Replit manages TLS certificates automatically, so there is never a risk of an expired certificate leaving your connection exposed.

Each deployment runs in its own isolated container, so your data never shares memory or storage with any other application on the platform.

Sign-in, sign-up, password management, and session handling are all powered by Clerk, an authentication infrastructure company trusted by thousands of production apps. Getting authentication right is genuinely difficult, so we rely on specialists rather than building it ourselves.

• SOC 2 Type II certified. Clerk undergoes independent annual audits confirming that credential and session data is handled to the same standard as enterprise software.
• Breach detection. Every password is checked against databases of known leaked credentials before it can be set. If a password has appeared in a breach anywhere on the internet, Clerk rejects it.
• Brute-force protection. Sign-in attempts are rate-limited automatically. Repeated failures trigger a lockout, blocking credential stuffing attacks before they can reach your account.
• Multi-factor authentication. Clerk supports additional verification steps beyond a password. Enabling MFA means that even if a password leaks, an attacker cannot access the account without the second factor.
• Email verification. Every new account goes through email verification before access is granted. Disposable or undeliverable addresses are rejected at sign-up.

Using Replit's built-in security tooling, we run several types of automated scans against ORCA's codebase regularly.

• Static code analysis (SAST) examines the application code and flags patterns that could lead to security issues, such as injection risks, unsafe data handling, and missing authentication checks.
• Dependency audits check every third-party library we use against known vulnerability databases, so any reported issue in a package we rely on appears in the scan results straight away.
• Secret detection scans the codebase to confirm that API keys and credentials live only in secure environment variables and have never been accidentally committed to source code.

Every finding is assigned a risk score and addressed in order of severity. Critical issues are fixed immediately, and lower-risk items are resolved before the next release.

The student records, guardian contact details, lesson notes, and invoices you put into ORCA belong to you. We do not sell that data, share it with advertisers, or use it to build profiles for any third party.

Data is stored in a PostgreSQL database with encryption at rest. Every connection between the application and the database is authenticated and encrypted. Access to the production database is restricted to a small engineering team, using secured credentials stored as environment secrets rather than in the codebase.

We share data with third-party services only when it is necessary to run the product. Stripe receives what is needed to process payments, and WhatsApp receives a phone number and message content for appointment reminders and account verification. That is the full list.

When you sign up as a coach, you verify your identity with a one-time code sent to your WhatsApp number before gaining access to anything. This confirms that you control the phone number attached to the account, so an email address alone is not enough to get in.

Sessions are issued and validated by Clerk on every request. If your account is suspended or deleted, access stops immediately. There is no window where an old session keeps working after a change has been made.

Each coach's data is kept strictly separate. You can only ever see your own students, invoices, and appointments, and this is enforced on the server for every single request. There is no way to reach another coach's data by modifying a URL or API call.