Security
Last updated 01 November 2026
This page describes how ORP1 Business Operating Platform protects your business, what you need to do, and how to report a problem. No online service can promise perfect security, so we prefer to be clear about what is in place.
Signing in
- Passwords are stored only in protected, hashed form
- Two-step sign-in with an authenticator app is available for owners, employees and our own team
- Repeated failed sign-ins are locked out
- Bot checks protect sign-in and public forms
- Our team's sessions end after a period of no activity
Keeping businesses apart
- Each record belongs to one business, and the system limits every request to it
- Roles control what each employee can see and do
- Medical report files sit in private storage, behind a permission check
- A suspended business loses access at once, including its API keys
Protecting data
- Sign-in sessions and saved mail passwords are encrypted
- API keys are stored as hashes, and web hooks are signed
- One-time codes are stored as hashes and expire in minutes
- The site sends strict browser security headers, including a content security policy
Watching what happens
- Sign-in attempts are recorded
- Important changes to records keep an audit trail
- Our team's actions on customer accounts are recorded
What we do not claim
We do not currently hold ISO 27001 or SOC 2 certification. If you need a specific control for a contract, ask us and we will tell you plainly whether we meet it.
What you can do
- Turn on two-step sign-in for every account
- Give each person their own login, with only the access they need
- Disable accounts as soon as someone leaves
- Review who has access regularly
Reporting a vulnerability
If you find a security problem, please write to support@orp1.com with the details and steps to reproduce it. Please do not access other people's data, disrupt the service or share the problem publicly before we have fixed it. We will not take action against anyone who follows this approach in good faith. Our contact is also published at /.well-known/security.txt.
Questions? Write to support@orp1.com.