Security
A public overview of the application boundaries used to protect accounts, saved strategy settings, product data, analytics, and provider credentials.
Authenticated product routes validate signed account claims on the server. Membership access is checked separately from public marketing pages, and privileged database credentials are not shipped in the browser bundle.
User-owned records are protected with row-level policies and explicit grants. Proprietary historical data and operational tables are accessed through trusted server code rather than exposed as public directories.
Mutation routes validate request bodies, enforce size limits, check origin where appropriate, and apply endpoint-specific rate limits. Webhooks require provider verification before trusted state is changed.
Product analytics are first-party, limited to operational and conversion events, and respect Global Privacy Control, Do Not Track, and the site’s analytics-cookie choice. Payment card details remain with the billing provider.
Operational health checks, job status records, safe server timing, and error handling support investigation without intentionally logging credentials or raw authorization tokens. Database migrations preserve auditable security changes.
If you believe you found a security issue, do not publish account data or exploit the issue. Send the affected URL, reproduction steps, and expected impact to support@orblytics.io.
Security is an ongoing process, not a guarantee. Users should protect their email account, avoid credential reuse, sign out on shared devices, and report unexpected access promptly. Review the Privacy Policy and Terms of Service.