> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Legal index

> Index of Orbit's public legal and trust surfaces — privacy policy and do-not-sell portal, terms of service, the Trust Center, the security overview, and open source attribution.

# Legal index

Orbit's legal and trust surfaces span two properties. Binding documents —
the privacy policy, terms of service, and Trust Center — are published
on the marketing site; the compliance guides on this docs site describe
the tenant-owned controls you operate. This page is the index across both.

<Note>
  This page is a directory, not legal advice. Your obligations depend on
  where your end users live and what data you process — confirm with
  qualified counsel.
</Note>

## What's legally public on Orbit

| Surface                                                               | What it is                                                                                                                                                    | When you care                                                                                             |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| [Privacy policy](https://orbit.devotel.io/en/privacy)                 | What personal data Orbit collects to run the service, how long we keep it, and the rights you and your end users can exercise.                                | Evaluating Orbit as a data processor, or responding to an end user's privacy question about the platform. |
| [Do-not-sell portal](https://orbit.devotel.io/en/privacy/do-not-sell) | Deterministic self-service flow a consumer uses to exercise the CCPA/CPRA right to opt out of sale or sharing — requests are processed under a published SLA. | A California consumer asks you how to opt out, or you map your CRA/privacy-ops intake paths.              |
| [Terms of service](https://orbit.devotel.io/en/terms)                 | The contract between you and Devotel — acceptable use, service levels, liability, and the governing law.                                                      | Reviewing the agreement you signed, or answering procurement questions.                                   |
| [Trust Center](https://orbit.devotel.io/en/trust)                     | SOC 2 control mappings, the subprocessor registry with data-residency notes, and downloadable agreements (DPA, BAA).                                          | Vendor review, a security questionnaire, or an auditor asking who else touches your data.                 |
| [Security overview](https://orbit.devotel.io/en/security)             | Encryption and network hardening, tenant isolation, key handling, and incident reporting.                                                                     | Your security team evaluates the platform, or you're re-running vendor risk assessment.                   |
| [Open source attribution](/legal/attribution)                         | License notices for the OSS components Orbit redistributes.                                                                                                   | Your legal team reviews redistribution terms, or you ship an Orbit SDK into your own product.             |

## Platform compliance controls

The documents above describe Devotel's commitments. The guides below
describe the **tenant-owned controls you operate** — consent capture,
opt-out suppression, data-subject requests, and the compliance posture
checks that gate sending.

<CardGroup cols={2}>
  <Card title="Compliance posture overview" icon="shield-check" href="/compliance/posture-overview">
    Per-jurisdiction gates, quiet hours, and the posture check that runs
    before every send.
  </Card>

  <Card title="SOC 2 control mappings" icon="clipboard-check" href="/compliance/soc2-controls">
    Which controls are platform-owned and which stay with your tenant.
  </Card>

  <Card title="HIPAA on Orbit" icon="file-medical" href="/compliance/hipaa">
    The BAA boundary and the controls for PHI workloads.
  </Card>

  <Card title="Data subject requests (DSAR)" icon="user-check" href="/compliance/dsar">
    Operator-filed and self-service DSAR intake, and the fulfilment pipeline.
  </Card>
</CardGroup>