A third-party audit of the project reportedly claimed that Orb devices do not record users’ iris-codes onto persistent memory and that they only transmit codes through end-to-end encrypted messaging.