Security and privacy

What Orion collects, who sees it, and how it is protected.

What we protect and how

  • Passwords hashed with Argon2id; optional TOTP two-step verification.
  • Sessions use random tokens stored only as hashes.
  • Role-based permissions checked on the server for every action.
  • Sensitive values (bank details, wallet identifiers, MFA secrets, webhook secrets) encrypted at rest; displayed masked.
  • Audit log of sensitive access, exports and changes.

What is not yet in place

Malware scanning, managed key storage, security monitoring and tested backups. Real documents are therefore not collected.

Your rights

You can ask to access or correct your personal information. Public blockchain data cannot be changed.