Security overview

Achos is built for mortgage broker workflows that include sensitive client information. This page summarises the visible controls we use to protect the platform and the boundaries brokers should understand before inviting clients into the portal.

Verified company identity

Achos is operated by Orbits Plus Limited, company number 17080111. Companies House lists the company as active and incorporated on 9 March 2026.

Orbits Plus Limited is registered with the Information Commissioner's Office under data-protection registration reference ZC128788. The registration runs from 20 April 2026 to 19 April 2027.

Encryption and hosting

  • Production is hosted on Microsoft Azure and configured in UK South.
  • Browser traffic is protected with TLS, HSTS and secure cookie settings.
  • Documents and sensitive file assets are encrypted at rest with authenticated file-level encryption.
  • Organisation-specific data encryption keys are managed through Azure Key Vault.
  • Application secrets are stored in Azure Key Vault rather than source code.

Access controls

  • Each broker organisation is isolated with its own tenant database.
  • Users are governed by role-based permissions and case-scoped access.
  • Broker sign-in supports MFA, and client portal sign-in supports passkeys and MFA.
  • Security-sensitive actions are rate limited and logged for audit review.

Client portal boundary

Achos gives broker clients a secure route to complete fact finds, upload documents, exchange messages and view case progress. The broker remains responsible for explaining why the data is needed, checking it, and deciding how it is used in the mortgage process.

What Achos does not claim

Achos is software, not a lender, adviser, conveyancer or insurer. The platform does not make automated mortgage decisions and does not replace the broker's regulatory duties, suitability checks or client disclosures.

Questions

For due-diligence questions, security reviews or privacy checks, contact contact@orbitsplus.co.uk. See also the privacy notice and service terms. Updated September 2026.