Verified sign-in
Amazon Cognito handles account authentication and email verification. The application checks active business membership and permissions on each request. Signing in does not grant access to another business.
ORIGINLITH BUSINESS RESOURCE MANAGEMENT
Security & Trust
A practical look at how your business workspace is protected, what we have checked, and what is still being prepared for launch.
Reviewed October 8, 2026 · Controlled pilot
Originlith LLC operates the current service as a controlled pilot for small businesses. This page describes implemented protections and dated checks. It is not a certification, a live uptime monitor, or a guarantee of uninterrupted service.
Your business has its own access boundary.
Permissions that fit the work
Administrators manage business access. Administrators and power users can work with business records. Standard employees see their own assigned training, credentials, software, and company documents; they do not receive coworkers’ records, business spending, or manager-only training notes.
Server-enforced separation
The server derives the business from the authenticated account. Database and document access use business-scoped permissions in addition to application checks. Changing a URL or a record identifier does not select a different business.
Protected sessions
Application sessions use secure, HTTP-only cookies. Business access can be suspended by an administrator. The password-reset recovery integration revokes earlier application sessions after successful recovery.
Private records and documents
The service uses HTTPS. Business data and uploaded documents are encrypted at rest in AWS. Documents are stored privately and are accessed through the application after authorization, using short-lived download links.
Uploads are checked against the expected file size and checksum, with a maximum of 25 MB per file. Those checks detect an incomplete or changed upload; they do not scan for malware. Only upload files you trust, and use your organization’s normal file-safety tools when opening downloads.
The active regional application, authentication, identity, and document services are in AWS US West (Oregon). Some earlier recovery copies remain in AWS US East (Ohio). Public content is distributed through AWS’s global delivery network.
Recovery and record history
- Point-in-time recovery: the active business and identity tables have 35-day recovery enabled. Uploaded files use versioned storage.
- Tested restore procedure: on October 1, 2026, an isolated table restore and reconciliation of the current documents passed. The temporary recovery tables were removed afterward. This checked the recovery procedure; it was not a complete application failover or a promised restoration time.
- History stays visible: record changes have activity history. Archiving preserves records and history rather than erasing them.
- Trial expiry preserves data: records and files stay saved, while business pages, exports, and private downloads are unavailable until verified paid access resumes. Administrators retain account and purchase options; other users receive administrator guidance.
See retention, exports, and deletion requests for the current pilot arrangements.
What has been checked
The October 2 readiness review included automated regression checks, mobile and desktop review, and live checks using disposable test businesses for business isolation, trial behavior, expense permissions, and password-reset session revocation. Customer records were not used to stage the advertised screenshots.
These checks support a controlled pilot. They are not an independent penetration test, a compliance assessment, or proof that every workload is supported. Larger-business bulk operations and very large workspaces still need capacity improvements before broader rollout.
Current pilot boundaries
- Online paid checkout and paid upgrades are not enabled. A purchase inquiry does not take payment.
- Due-date tracking and the in-app business inbox are available. Scheduled customer reminder emails are planned.
- Company documents track assignments and uploaded signed copies. Direct electronic signing and signature verification are not included.
- No SOC 2, ISO 27001, HIPAA, or FedRAMP certification or compliance claim is made for this application.
- A contractual availability guarantee, fixed support response time, and guaranteed recovery time have not been established for the pilot.
Questions or a security concern?
Email support@originlith.com. For a suspected issue, include the product, approximate time and time zone, affected page, and a brief description. Please leave passwords, verification codes, private documents, and other people’s data out of your first message.
If you have a specific security, data-location, retention, or procurement requirement, discuss it with us before entering that data into the pilot. We can explain the current system and identify any work needed for your business.