Security
This page lists what is built and tested today first. What is still in development or only planned comes after it, with a badge. If a detail is not on this page, we are not claiming it.
Sign-in that fails the same way for everyone, and sessions you can see and end.
Sign-in answers alike for a wrong password, an unknown address and a disabled account. Ten failed sign-ins per address in 15 minutes are throttled, with a Retry-After header.
Orbit enforces a password policy: by default a password needs at least 10 characters. Site administrators can read it.
Read more in the docsSessions use an HttpOnly, SameSite=Lax cookie backed by Redis, with the Secure flag on HTTPS. Each person sees their signed-in devices and can sign out one or all others.
Read more in the docsA password change or reset signs out every other session.
Password reset links are single-use, stored hashed, valid for 60 minutes and limited to five an hour per account.
Guests see only the projects they are invited to. Service accounts never sign in. Revoking a token takes effect on the next request.
Read more in the docsEach company has its own address, and the database enforces the boundary.
Orbit’s cloud runs on servers in Hetzner’s Helsinki data centre, Finland (EU).
PostgreSQL row-level security covers all 139 site tables, and the site is resolved from the Host header. Anything without a valid site is denied.
Read more in the docsA two-site browser test runs two companies side by side with the same project keys and foreign ids. Isolation was tested with a full concurrency run and a two-site backup and restore.
Every API, search, export and live event excludes other tenants.
One scheme everyone can read, and a record of what changed.
An append-only audit log is written in the same transaction as the change. It filters, pages and exports as CSV, and the export is itself audited. Secrets are redacted.
Read more in the docsThe permission scheme is readable by everyone. The permission helper shows a person’s allowed and refused permissions with the reason, computed by the same SQL the API uses.
Read more in the docsPersonal API tokens are read or read/write, can be limited to projects, expire within a year, are shown once, revocable, and rate-limited to 600 requests a minute.
Read more in the docsWho may open Code/CI, Observability, Knowledge and Lumen is set per person and enforced at the web proxy.
Security behaviour is tested, and dependencies are checked before every delivery.
Tests cover tenant isolation, IDOR, stored XSS, CSRF (origin checks on writes), SSRF (an outbound guard for user URLs), upload safety and privilege escalation.
npm audit and govulncheck run before every delivery, and the Go toolchain was pinned after a vulnerability scan.
Rich text and Markdown render without script execution in Orbit, Folio and Lumen.
CSV exports neutralise spreadsheet formulas, and every export is recorded with its digest.
Data survives restarts, outages and mistakes, and restores are rehearsed.
Backups include attachments and configuration. Restore drills check row counts and the hash of every attachment.
Read more in the docsMigrations only go forward. A downgrade means restoring the backup.
A PostgreSQL or Redis outage answers a typed, retryable error. Committed work survives and workers resume without duplicates.
Per product
Forge, Pulse, Folio and Lumen add their own protections on top of the shared platform.
CI secrets are encrypted with AES-256-GCM and masked in logs, including across log chunk boundaries.
OIDC id_tokens let jobs reach cloud providers without long-lived keys.
Jobs run in ephemeral, non-root containers without the Docker socket or service credentials.
Secrets are refused at push, and a hash-chained audit trail records governance events.
Ingest keys are hashed, shown once and never use sessions. The origin is checked on writes.
Session replay is masked in the browser by default.
Attachments are type-checked by extension and by bytes, and served with nosniff and a sandbox content security policy.
Public links are hashed, expiring and revocable. Restricted pages are never published.
The server has no write path to any product. Every change is a card your browser runs.
Product content reaches the model as untrusted data. An attack set of injections runs on every delivery.
On Orbit’s cloud, Lumen answers with Claude Haiku 5.5 from Anthropic. The number of questions an organization can ask is set by its plan.
Only the question, page context and manifest fields reach the model. Agent sessions are read-only, last ten minutes and are rechecked on every request.
Built and in final testing, not yet open to everyone. Single sign-on and SCIM come with the Business and Enterprise plans.
In development SAML 2.0 and OIDC single sign-on with signed-assertion checks, ForceAuthn, replay protection and certificate rotation. Okta and Microsoft Entra ID are tested.
DocsIn development Enforced single sign-on per organization: with the required policy, managed accounts cannot use passwords, and a recovery owner is kept.
DocsIn development SCIM 2.0 user lifecycle with scoped bearer keys (at most two live) and immediate deactivation.
DocsDesigned and not started. None of this is available today, and we will not describe it as if it were.
Planned Multi-factor authentication on password sign-in, on every plan.
Planned Password rules set by each company’s administrators for their own organization: maximum length up to 64, upper and lower case, digits, symbols and not the e-mail name. Today only the 10-character minimum applies by default.
Planned Sign in with Google and Microsoft, on every plan.
Planned Audit log retention by plan: 30 days, 90 days and 1 year.
Planned Zero-downtime deployment of the platform.
Planned Monitoring of your own databases, with query text normalised on an agent in your network so values never leave it.
Planned A self-hosted Enterprise licence checked offline. On such an installation Lumen can use an open-weight model through an OpenAI-compatible endpoint, with a paid provider only when an administrator adds a key and a budget ($0 by default).
Planned Legal documents: Terms, Privacy, Refunds, DPA and a sub-processor list. They are in preparation before launch.
Reporting
A security contact address will be published before launch. Orbit is in private preview, and nothing is sold yet.
Until then, please use the contact page and mark your message as a security report.
Read how the platform is built, or talk to us about Enterprise requirements.