Security at OrbitAlert

• All traffic to the dashboard and API is served over HTTPS/TLS; plain HTTP is not offered.
• HTTP Strict Transport Security (HSTS) is enforced on every response.
• Connections to our database are TLS-verified (certificate chain + hostname) by default — not just encrypted, but authenticated against man-in-the-middle interception.

• Dashboard sign-in is handled by a dedicated identity provider (session tokens, not passwords we store), with optional two-factor authentication (TOTP) available from your account settings — recommended for every organization admin.
• SSO / SAML is available for Enterprise customers — connect your own identity provider (e.g. Microsoft Entra ID, Okta) so your team signs in with existing corporate credentials. Contact us to set up a connection.
• API keys are random 24-byte tokens. We store only a salted SHA-256 / HMAC hash of each key — the raw value is shown to you once, at creation, and never again.
• Every authenticated API request is scoped to your account; you cannot read or modify another customer's alerts, keys, or webhook logs.
• IP allowlisting is available on Research and Enterprise plans — restrict API access to specific IPs or CIDR ranges from the IP Allowlist page.

Alert webhooks are validated at both registration and delivery time to prevent your account being used to attack internal infrastructure (SSRF): loopback addresses, private IP ranges, link-local and cloud-metadata addresses, and non-HTTPS URLs are all rejected. Delivery requests do not follow redirects.

Every delivery is signed — an X-OrbitAlert-Signature header carries an HMAC-SHA256 of the exact request body, keyed by a secret unique to each alert (visible in its API response), so your endpoint can verify a webhook genuinely came from OrbitAlert. See the verification guide for copy-paste Python and Node examples.

• Per-API-key and per-IP rate limiting on every endpoint.
• Stricter limits on account-creation and key-generation endpoints to prevent enumeration and mass account creation.
• Request size limits to prevent oversized-payload abuse.

OrbitAlert runs on established managed-cloud providers for compute, database, and frontend hosting rather than self-managed servers — we inherit their physical security, network isolation, and patching practices. A current list of infrastructure and processing sub-processors is published in our Data Processing Agreement.

Card payments are processed entirely by our payment processor (Stripe) — OrbitAlert never receives or stores your full card number. Billing webhook events are cryptographically signature-verified and processed idempotently, so a retried or forged event cannot double-charge or corrupt your subscription state.

• Automated uptime monitoring on our public API with alerting on outages — see live status at /status.
• Security-relevant account events (key creation/revocation, plan changes) are recorded in an internal audit log.
• Automated dependency and secret-scanning on every code change, with weekly scheduled scans.

We process personal data in line with the GDPR. See our Privacy Policy for what we collect and why, and our Data Processing Agreement for our processor obligations, sub-processor list, and international transfer safeguards.

• Data export. Signed-in customers can export every record their organization owns as JSON, and download the full, personalized Data Processing Agreement as a signable PDF, from the Account page.
• Right to erasure. Organization admins can request permanent deletion of their organization and all its data from the same page — confirmed by email link before anything is deleted.

If you believe you've found a security issue in OrbitAlert, please report it responsibly — do not test against other customers' accounts or data.

We acknowledge reports within 2 business days and will keep you updated as we investigate. Full policy — scope, safe harbor, and what to expect — at Security Disclosure Policy.