We don't ask you to trust us — we show our work. Every security control is documented, auditable, and built into the platform architecture.
| Control | Description |
|---|---|
| Role-based access | Owner, Admin, and Agent roles with distinct permission sets. |
| Granular permissions | Per-user toggle for call logs, phone numbers, knowledge base, config, billing, and test calls. |
| Team groups | Group users with shared permission overrides. Assign colours for visual identification. |
| Session security | Sessions invalidated on password change. HTTPS-only cookie flags. CSRF protection on all state-changing endpoints. |
| Rate limiting | Login: 5 attempts per IP per window. Signup: 3 attempts per IP per window. Backed by an in-memory cache with automatic unlock. |
| Admin URL randomisation | Admin panel served at a configurable randomised path — not discoverable via standard URL scanning. |
| API key auth | X-API-Key header only. Query parameter auth disabled (would appear in access logs and proxy caches). |
| Developer audit log | Every API key create/revoke/rename, billing top-up, and webhook change recorded with IP address. |
Every Orinode webhook includes an HMAC-SHA256 signature. Verify it on your server to reject spoofed requests.
# Python — verify Orinode webhook signature import hmac, hashlib def verify_orinode_webhook(payload_bytes, signature_header, secret): expected = hmac.new( secret.encode(), payload_bytes, hashlib.sha256 ).hexdigest() received = signature_header.removeprefix("sha256=") return hmac.compare_digest(expected, received) # In your view: sig = request.headers.get("X-Orinode-Signature") if not verify_orinode_webhook(request.body, sig, YOUR_WEBHOOK_SECRET): return HttpResponse(status=401)
| Header | Value |
|---|---|
| X-Frame-Options | DENY — prevents clickjacking |
| X-Content-Type-Options | nosniff — prevents MIME sniffing |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| Content-Security-Policy | Restrictive policy — no inline scripts, no eval, allowlisted origins only |
| Strict-Transport-Security | max-age=31536000; includeSubDomains (production) |
| Server | Orinode (stack fingerprint hidden) |
We take security reports seriously. Contact our security team with a detailed description and proof-of-concept. We aim to respond within 24 hours.
security security@orinode.ai