Skip to content

What stops it
limits, waits, and a person where it counts

The autopilot pays only inside the mandate you signed. The brakes below sit above every mandate, and no plan or setting turns them off.

Book a demoJoin the waitlist

Brakes

Six brakes
above every mandate, on every plan

  • By itself today
    $6,400of $10,000
    Largest payment $1,850 · cap $2,000

    $2,000 a payment, $10,000 a day

    The most it ever pays by itself.

  • Waits 24 hoursPending
    Sam raised the Tools budget$1,500 to $3,000 · takes effect tomorrow 15:40This wasn't me

    Loosening waits one to three days

    Another owner can cancel it, or say it wasn't them.

  • Brightpress$412
    Bank details changed since the last bill
    Waiting for an ownerReview

    A new payee is always a person

    So are changed bank details, whatever the mandate says.

  • Autopilot
    Paused by Mira at 10:427 payments wait for a press

    One pause stops everything

    No dialog, no second question.

  • Supervisor
    Four times the usual$8,900
    Northline Studio is paused until a person looks

    The first anomaly stops the space

    Until a person has looked.

  • Hosting and infra$600
    Airwallex · Operating · paid by itself
    ExecutedMandate · Tools, line 2

    Every row says why

    Which line of the mandate let it through.

API keys and connected agents cannot add a payee or change a limit.

Who you pay

Who is on the other end
checked before the money leaves

Counterparty checkNorthwind LtdContact · supplier
  • SanctionsClear
  • PEP, criminal lists, mediaClear
  • Companies HouseFound, active
  • Wallet 0x7a…c2Low risk
By name
A contact is screened against sanctions, politically exposed persons, criminal lists and adverse media, and a company is confirmed in its registry: VIES, GLEIF, Companies House or a US state register.
By address
A wallet is screened before you pay it, and a blacklisted one keeps Send off until the sender overrides it on purpose. Watched addresses are screened again on a schedule, and the senders of money coming in as it lands.
To the details that were signed
A signature holds for the bank details it was given on. If they change before the money leaves, the payment comes back for a new signature.
Patterns between the people you pay
Nine plain checks on crypto payouts, such as a contractor's money coming back to an employee or one payment split into many small ones. Each finding says which pattern matched and why.

Your money

Where the money sits
and whose key moves it

Euros are held in dollars: an IBAN payment turns into USDC at the day's rate, and a payout in euros converts back.

Who signs

A person presses last
unless the mandate already said yes

Payments

Waiting for you$2,8122 payments
Waiting for others$16,1985 payments
Paid by itself$6,40011 today

Over $2,000 needs 2 signatures

Waiting for you2
  • BrightpressMercury · OperatingBank details changed$412PendingSign
  • Dmitri VolkovRevolut · OperatingOver $2,000, needs a second signature$2,400PendingSign
  • Hosting and infraAirwallex · Operating · Mandate, Tools$600Executed

Bank by bank, on launch day

Oversight

Who approved is not who sends
and a report says what machines decided

Who may move money here
  • MiraOwnerApproval rules
  • AlexMember$5,000 a month
  • Research agentAgentWallet and card, $50 a day
  • Month-end transferAutomationOwn accounts only
Sent by someone else
A rule can ask that money it cleared is sent by a person who did not approve it, and nobody signs their own proposal.
Lowering what a client owes
A credit note, a write-off, a void, or an invoice marked paid with no bank row behind it. Past the space's line, another owner or admin approves it first.
A monthly control report
Frozen the day after the month ends: what machines decided alone, what people signed against the quorum, and what was flagged.
Every action in one file
The activity log exports with who acted: a person, Orla, an agent or the system.

Your data

Where it lives
and who can reach it

  1. 1People in this spaceWhat their role allows
  2. 2Agents you connectedNever more than you
  3. 3Orla staffThe shape, never the contents
  4. 4Outside servicesOnly what you switched on
Where the money is
In your banks, on your exchanges and in wallets you sign, including the ones behind your accounts inside Orla. Orla holds only a prepaid card balance and an agent's wallet.
Who signs
A person on your team, or the autopilot inside the mandate you signed. Over the threshold, a second person signs too.
What an agent does alone
Spends from its own wallet and its own card and nowhere else, inside the limits you set. It never signs for your accounts.
Certificates
SOC 2 and ISO 27001 are in progress.
How to leave
Export your rows, then Delete account in Settings, Privacy & data erases your personal data. An owner can delete a whole space.
What the AI sees
Labels in place of bank details, and documents read on our servers first. Every send to an AI leaves a receipt in your access log.

Every detail, chapter by chapter

Where it is stored, and who can reach it

Built from your account, so everything on it is true for this space right now.

Where it is stored

The application
London, United Kingdom, on managed infrastructure behind a firewall.
The database itself
Amsterdam, in the EU, managed the same way.
From the open internet
The database accepts none; only the application reaches it.

Encrypted on top of that

With our key, before anything touches the disk, so a stolen database dump is only ciphertext.

Uploaded receipts and documents
Encrypted with our key on the way to the disk.
Bank, exchange, messenger credentials
Encrypted with our key, and never shown back to anyone, not even you.
What a statement scan read
Encrypted with our key, in the same way as the file it was read out of.
Card identity data
Kept only until the issuer accepts it, then deleted.
Wallet keystores
Ciphertext only, encrypted in your browser; we never hold the seed.
Money Orla holds
Two places only, both funded by you: the prepaid card balance and an agent's wallet, whose key Orla keeps to sign inside your limits. Nothing in your bank, exchange or own wallets.

Who can reach it

People in this space
Exactly what their role allows, and nothing at all from your other spaces.
Agents you connected
Never more than you could do yourself, recomputed on every call.
Orla staff
The shape of the account: plan, connections, whether a sync is failing. Not the contents, and every action logged for you to read.

What we do not have, and how to leave

Certificates
SOC 2 and ISO 27001 are in progress. Until they land: named locations, a database the internet cannot reach, encryption before disk, and a staff log you can read.
Taking it all back
Settings, Privacy & data, Delete account erases your personal data; an owner can delete a whole space, which ends it for every member. Both ask for confirmation first, and your rows stay exportable right up to either.
Telling us about a hole
[email protected]. We answer, we say what we found, and we do not argue with the finder about whether it counted.

What leaves, and to whom

Who receives what, because of what this space switched on. Nothing is sold.

Anthropic, for Copilot and scans
What a question needs, plus the contents of the file being scanned.
OpenAI, for a voice message
A voice note sent to the Telegram bot or an audio clip in Slack goes there to be turned into words, and nothing else about the space goes with it. The space's AI switch turns voice off with the rest.
The open banking provider
Behind your bank links, and your banking password never reaches Orla.
The exchanges you connected
Read-only, by the key you made there.
Public blockchain nodes
Asked about the addresses you watch.
AMLBot, screening a destination
It receives the address, not you.
dilisense and the company registers, when you check a counterparty
The name on that contact, and a company's registration number. Only on a press.
Telegram and Slack, once connected
What the space posts to the chats you linked, and nothing before you link one.
Whoever runs an agent you connected
What that agent reads, inside the access you gave it.
Email delivery and crash reporting
The two that do not depend on a setting: the mail the app sends you, and the error reports.

What the assistant is handed

Keys, tokens and passwords
Cut out at the door to the model: provider and API keys, session tokens, agent wallet keys, card numbers. A statement being scanned still goes, because reading it is the job.
Labels, not bank details
The model reads a label, such as IBAN_1 ending 5555, in place of every account number, card, wallet address, email and phone, the ones you type included. You get the real value back in the answer. Only the space owner can switch it off, and every change is a line in the activity log.
A note you asked it to keep
Goes in as data, never as an instruction, and only from a card you pressed or from Settings. Card numbers, IBANs, keys and passwords are refused. Rolling out.
The AI switch
The space owner turns all of it off in Privacy & data: answers, category suggestions, scans, receipt reading and voice.
Documents read here first
A PDF, a scan or a photo is read on our own servers first, so the model gets text with those details as labels and the picture stays here. A scan too unclear to read goes as it is, and its receipt says so.
A receipt for every send
Each time anything from the space goes to an AI, a row lands in the access log: who received it, what for, how much left and what was masked. It counts what went and never repeats it.
Files we could not open if we wanted to

Not for support or a court order. Documents are encrypted in your browser; amounts and names stay in the ledger we compute on.

How the vault works

What it covers
Receipts, statements and documents, all encrypted in this browser before they reach us at all.
What it does not cover
Amounts, names and the rest of the ledger, which we hold and compute on.
The vault phrase
Twelve characters or more, and not your sign-in password; we never see it.
The recovery code
Shown once and never again: we keep no copy of it, so print it.
The key while you work
It lives in this tab and dies with it; a remembered browser asks for a passkey instead of the phrase you typed.
If both are lost
Nobody opens the files again, so they can at least be erased. Switching the add-on off later never locks you out of them.

Your own storage

Google Drive
One folder of Orla's own, and nothing else in your Drive is visible to it.
An S3 bucket you own
AWS, Cloudflare R2 or MinIO, where the files stay ciphertext too, so your provider cannot read them any more than we can.
New uploads
Go straight to your bucket once it is connected, and the plan's storage limit stops counting those spaces: the bytes are yours, not ours.
The files already here
Moving them over is paused for now; the block says so and counts what has moved. They stay in Orla's storage, encrypted as always, and open as usual until the move resumes.
If the add-on lapses
Only new uploads go back to Orla. What is in your bucket stays there and opens as before, and the keys are kept until every file is back.
Every way in, and every way back out

A password reset or Sign out everywhere ends every session at once. A device signed out alone works up to 15 minutes on its token.

Ways in

Passkey
Face or finger on this device, and a fresh challenge the server checks rather than a remembered session.
Password
Twelve characters at least, and changing it signs out every other device, even one you have lost.
Google, or an Ethereum wallet
If you would rather not have a password at all.
Authenticator code
Attempts are capped, then the account locks.
Recovery codes
Single use, printed once; the last method you have left cannot be removed.
A step up for dangerous things
A passkey or a code at the moment, for settings that would let money out.

Was that you?

It was me or Not me, in the app and by email.

A sign-in from a new device
Not me signs out the device the alert names, never the one you are answering from, and a device cannot escape it by renewing its session while you answer.
A sign-in token used a second time
The sessions that came from it are signed out already, and the card says why.
Five failed sign-ins inside an hour
Told once a day. Not me signs out every other device and points you to the password form.
Somebody blocked by the IP list
Goes to the owner and the admins of that space, once a day per address, with Allow this address next to Got it.
The email about it
Links to the card, and every answer is a line in your security log.
Something you know, and something you have

A crypto send needs the wallet password, plus a passkey once you switch it on. Over the threshold, a second person signs.

A crypto send, step by step

The wallet password, always
It decrypts the key, and it is not your sign-in password; typed by you. Twelve characters at least, because it is the one thing in front of the encrypted key.
The passkey, if you switched it on
Also ask for Face or Touch ID on sends: with the switch on, the server does not release the encrypted key until a fresh passkey challenge answers, so a send needs both.
Without that switch
Before the encrypted key is released the app can ask you to confirm it is you: the account password, an authenticator code, a passkey, or the Google or wallet sign-in the account uses. One confirmation covers fifteen minutes.
Every release is announced
When the encrypted key is handed to a signed-in session, the wallet's owner gets a notice, Wallet key was unlocked, at most one a day per wallet, so a release nobody made stands out. Releases are rate limited as well.
Where the key is meanwhile
Encrypted in your browser, decrypted only for the signature, never by us.
A copied session elsewhere
Has no wallet password, so it cannot decrypt the key; with the passkey switch on it is not handed the encrypted key at all.

Paying from your own bank: who presses last

The money never passes through Orla. Inside the mandate Airwallex, PayPal and the account inside Orla pay by themselves; on the rest, Revolut Business among them, a person presses last.

Revolut Business
Orla prepares the run as a draft inside Revolut, and a person approves it there. The key your company created has no right to pay.
Mercury
Orla reads, and requests a payment. The guarantee is in the token: it carries no Send Money permission, so nothing Orla holds can pay by itself. An admin approves or rejects the request in Mercury's own queue.
Airwallex
Pays by itself inside the mandate and its limits. Past it, the batch stays a draft for your approval workflow there.
Slash
The honest exception: Slash has no drafts. Orla sends only when a person with the right presses Send via Slash on an approved payment; your rules in Slash are the second guard.
Safe
Orla reads the Safe from the chain and proposes a transaction as a delegate. It never signs as an owner and never executes. The owners sign to the threshold and execute in Safe{Wallet}.

Mail about money

Who it comes from
An invoice, its reminders, a receipt and a quote come from Orla, and the subject names the seller. The From line stays Orla on purpose, so a mail about money cannot pretend to come from someone else.
Where a reply goes
To the seller: the billing email printed on the document, or else the verified address of whoever made it while they are still in the space, or else the owner's verified address.

What asks for what

Signing in
A passkey, or a password and a code.
A crypto send
The wallet password, plus the passkey where you switched it on.
Opening the vault
The vault phrase, or a passkey on a browser that you chose to remember.
Releasing a payment
Your own signature, and a second person's once the threshold is passed.
Changing security settings
Asked again at the moment: an allowlist, an approval rule or a payout list.
A space that only opens from your own addresses

Per space, so signing in is never gated by it, and denials go to the same log.

How a rule behaves

A range or one address
A whole range in the notation you already use, or a single address, with an expiry date if you want one.
Where a key is used
The build machine that calls the API gets a rule of its own, not only the desk where a person sits.
Outside every rule
Refused before it reaches this space's data, and logged as a denial.
Locked yourself out
A recovery link by email opens one door for one network for thirty minutes, pinned to the address that used it; it never switches the allowlist off.
An address a request cannot prove
Counts as a denial, so stripping a header is not a way around the check.
Two spaces, one person
One person can be in a restricted space and an open one at once, and the two never affect each other.
A role is a start, the switches decide

Every action that changes the books asks for its own switch, in the app and in the bots alike; a switch turned off wins over the role.

What each role starts with

Three handovers below are rolling out space by space; until then only Admin and Member switches can be edited.

Owner
One per space, and billing sits here. Sees everything, can do everything including deleting the space, and signs.
Admin
Sets the rules and invites people: rules, cards, connections, people. Signs.
Member
Can hold a card with a ceiling of its own, sees the accounts you tick, requests payments and spends inside a limit. Requests only, never signs; the owner can hand one the card pool.
Accountant
A seat, so nobody emails a spreadsheet: the books, the documents and the exports, to read and hand over, never to sign; the owner can add the assistant to the seat.
Agent
The spaces you named, with masked details, and writes inside a daily cap. It spends alone only from its own wallet, and never signs for your accounts.
Can only look
For the person who should see and not touch: what you allow, nothing else. The owner can hand them the ledger to write in.

The nineteen switches

Each is a lock of its own on the person's card in Team & access, on the Scale plan; the other plans use the plain roles.

Ledger
Write ledger transactions; goals, debts, recurring payments and loans ride on the same switch.
Payments
Propose payments, approve or reject payments, execute approved payments. An expense claim is proposed with the first switch and decided with the second one.
Accounts
Manage accounts & connections.
Business
Manage invoices & pay links, manage contacts, account codes & accountant exports. The tax centre's settings, the report builder's templates and the shared month card go with the last one.
Budgets, documents, cards
Manage budgets & categories, manage documents, manage the card pool.
AI & automation
Manage automation rules, and use Copilot and statement scans, which the bots in Telegram and Slack ask for as well.
Treasury and security
Swap and bridge assets, deposit to and withdraw from lending, release a wallet signing key, run paid AML screenings.
Team
Invite & manage the team, manage space settings. These two an admin can lose and nobody below an admin can be handed, because they are how a person would promote themselves.
The owner
Has no editor: every switch, always. Anyone else opens their own card and reads what they may do, so a refusal reads as a rule and not as a bug.

Hidden sections

Being switched on space by space, for business spaces.

What can be hidden
Reports, payments, the card pool, the team, documents, for a member of a business space: any section but the four that are the person's own, the home, the settings, the security section and People.
A lock, not a missing button
The section leaves the rail and the menu, its address opens a page saying it is hidden for you, the section's own screens refuse to load, its card leaves the home, and the built-in assistant is not handed its tools.
What stays
Totals and search still count every account the person may see. The owner sees everything, and a member sees which sections are hidden.
What it is not
Hiding covers the screens, the bots and the built-in assistant. A person's own AI client reads by role and ticked accounts, so keep a figure private with those.
In the chats
A section hidden from a person refuses the Telegram or Slack command with the same words as the page, whether the command reads it or writes it.

Agents and outside AI clients

A refusal leaves a line
Every refusal to an agent is written down with its reason, and stays readable after the key is revoked.
The services an agent may pay
Host names only: IP addresses, wildcards, odd ports and logins in the address are refused. Lookalikes stay in their xn-- form. An empty list is a closed door.
Where a host is paid
The first payment pins the host's address; a later one is refused until a person confirms it by hand. The very first goes where the host said: that is the honest edge.
Approving an AI client over MCP
Approved only in the browser that started it; a forwarded link has no Allow. The page shows the address asking and where the answer goes.
Reports over MCP
Details masked unless approved. An agent limited to some accounts sees only their reports, and no report lists the team or what each person spent.

Boundaries

What Orla will not do
no matter who is asking

Never

  • Move money outside the mandateInside it, only from banks that allow it and under the brakes above. A bank feed only reads.
  • Trade on an exchange keyRefused on connect.
  • Hold your wallet seedCiphertext only, in your browser.
  • Open your books in supportNo such screen exists.
  • Sell what a connection sawNot to anyone, at any price.
  • Let an agent sign for your accountsOr widen its own access; no setting changes that. It spends on its own only from its own wallet and its own card.
  • Let your own AI client move moneyA personal connection has no payment tools to call.
  • Rewrite an amount already bookedNot the assistant, not an agent, not you: a correction is a new record.

Yours, on request

  • A full exportCSV, PDF and the documents.
  • Deleting the accountAfter the export, and it is real.
  • Turning analytics offAnd it stays off.
  • Taking your files elsewhereYour own Drive or bucket.
  • Cutting a connectionWhat it imported stays yours.
  • A space only for your addressesOn the top plan.
The assistant, in particular

One card, one press. Money, the team, the settings and closing a month are never batched.

Sign a payment, or advise a signature
A brief, not a verdict.
Decide a duplicate bill for you
It says what matched; both papers stay, and the verdict is two presses of yours.
Block a payment that looks unusual
It explains, it never blocks.
Cancel a subscription at the supplier, or file a return
It names the day a VAT period closes, not a filing date, and files nothing.
Open a closed month
Never.
Post a comment in a thread
There is no tool for it under any name, and that is a decision, not a gap.
Change how you get in
Password, two-factor, passkeys, the email, sessions, the export, a deletion, the AI switches, allowed networks and messenger links are yours to change, on their own tabs.
Offer a role above the asker's own
Nor the owner role, nor a child's.
The one exception to the card
Two tax settings it changes by itself, because neither is a number on a return: which tax line a category reports on, and which month the reporting year opens on.

Checks

The parts that are not a promise
a build fails without them

Before the merge
  • Every route states who may call itPass
  • Unsafe patterns scannedPass
  • Written audit in the changePass
  • Webhook signatures fail closedPass
One red line and the change does not ship

Enforced by the build

Every route states who may call it
A missing rule fails CI.
Rules that ban unsafe patterns
Scanned on every commit.
A written audit before the merge
It travels in the same change as the code, with a fixed checklist, and the build fails without it. A reviewer reads the diff as an auditor would and blocks the merge on a high finding.
Webhooks with a bad signature
Refused, and never allowed to fail open.
The same payment sent twice
Refused by an idempotency key.

Watched while it runs

Failed sign-ins
Capped, then the account locks.
Providers having a bad day
An alarm on our side, and the app says so rather than inventing a number.
Errors in production
Traced, with an owner.
A stale figure
Labelled as stale, never shown as current.
Every admin action
In a log you can read on your own screen.

Under the hood

Passwords
Hashed, never stored.
Sensitive secrets
Encrypted at rest.
Sessions
Short-lived tokens, and a refresh token in a secure, http-only cookie.
The database
Firewalled to the application.
A reused refresh token
Signs out the sessions that came from it, the line of that one device and not every device, and raises a card asking whether it was you. The event lands in your security log.

Questions

About safety
the short answers

Can Orla staff read my transactions?

No. Support has no screen that opens your books. Every export, download and model answer is written to a data access log you can read yourself, including anything our own staff caused.

What is needed before crypto leaves?

The wallet password, always: it decrypts the key in your browser and is not your sign-in password. A passkey is a switch you can add on top, and with it on the server does not release the encrypted key until the passkey answers, so a send needs both. It works with any platform authenticator, Touch ID included.

Can Orla send money from our bank account by itself?

Inside your mandate, from Airwallex, after a pilot, and never more than $2,000 a payment or $10,000 a day. From Revolut Business, Mercury, Slash and a Safe a person always presses last.

What happens to my sessions after a password reset?

Every session that existed before the reset ends. Documents can also be encrypted so that we could not open them for support, for a court order or by mistake, and switching that off later never locks you out of what is already encrypted.

Found something?

Write to [email protected] before you publish it. It is the address our security.txt file names, and we do not argue with a finder acting in good faith.

Report a vulnerability

Read next

See the brakes on your own books
on a thirty minute call

We draft your first mandate with you and show where each brake sits.

Book a demoJoin the waitlist

Cookies

We count visits and measure the ads that bring people here. None of it touches your accounts or your money. Privacy policy