B+
Trust rating
Good · 88/100
Procurement snapshot
0 critical findings identified — these point to architectural gaps, not just configuration tweaks.
Strengths
Known Breaches
TLS Configuration
HSTS Header
CVE Exposure
Questions to ask
Confirm DNSSEC rollout timeline
Estimated remediation effort: 1–2 days
Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.
Trust Score Trend
→ No change
1 scan · Last scanned February 18, 2026
Your rating
Industry average
Score
100
75
50
25
0
B+
88/100
Compliance & Certifications
SOC 2 Type II
3rd party · AICPA
Pro subscribers only
ISO 27001
3rd party · accredited body
Pro subscribers only
GDPR
Self-reported
Pro subscribers only
Incident History
None in 12 months
March 2026
ChatGPT data exposure
1 source
Pro subscribers only
April 2023 – Feb 2026
ChatGPT data exposure
1 source
Pro subscribers only
Security Posture
2 items need attention
8 passed
Add 5 missing security headers
Security Headers
This leaves visitors exposed to attacks like clickjacking and content-type sniffing. orangewood.co is missing 5 of the 5 security headers browsers use to protect visitors — for example, one stops your site being loaded inside a hidden frame on another site to trick people into clicking things (clickjacking). These are settings, not code changes, so they're usually quick to add.
PCI-DSS 4.0Req 6.4.1
Security headers are required application controls
OWASPSecure Headers
Recommended baseline for web applications
How to fix this
1Add these headers exactly as shown. You're using Amazon CloudFront in front of this site — add it there, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html.
Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; script-src 'self' 'unsafe-inline'; upgrade-insecure-requests
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
2Confirm it worked: search "http header checker" and enter orangewood.co — check the headers below in the response.
Report unlocked.
View all 8 passed checks
Known Breaches
TLS Configuration
HSTS Header
CVE Exposure
DMARC / Email Security
MX Records & Mail Provider
Certificate Hygiene
Subprocessors & Tech Stack
Company Signals
Claim profile →
Operational risk
Low
11 yrs operating. Well-funded
Lynxradar · Composite signal
Last funding
$40B
Series F · Mar 2025 · SoftBank-led
Crunchbase ↗
Employees
~3,000
+40% YoY growth
LinkedIn ↗
Trust Resources
Claim profile →
Trust Center
trust.orangewood.co ↗
Security page
orangewood.co/security ↗
Privacy Policy
orangewood.co/privacy ↗
DPA (Data Processing Agreement)
orangewood.co/dpa ↗
Updated recently
Subprocessors List
orangewood.co/policies/subprocessors ↗
Tech Stack Detected
Subprocessors
Amazon CloudFront
Similar companies in B2B SaaS / Software
Appears in
Claim profile →
SOC 2 Type II certified vendors
847 companies · Updated weekly by LynxRadar
ISO 27001 certified SaaS
312 companies · Updated weekly by LynxRadar
Top AI vendors by trust score
94 companies · LynxRadar ranking
Enterprise-ready SaaS · Trust score A or above
203 companies · LynxRadar ranking
