Security
1. Encryption in transit
TLS 1.2/1.3 and HSTS are used for data in transit.
2. Two-factor authentication
TOTP two-factor authentication is supported. The 2FA secret is stored encrypted on the server.
3. Rate limiting
Login and authentication endpoints are rate limited.
4. Access permissions
Access is role- and capability-based, with per-user module permissions and department scoping.
5. Audit log
Record creation and changes, approvals, exports, and mobile screenshots (Android 14+) are logged.
6. Period locking
Records in closed periods cannot be changed.
7. Approvals and budget protection
Multi-step approval chains and budget overrun protection are available.
8. User and session management
Access is revoked immediately when a user is deactivated. Sessions and devices can be listed and their sessions terminated remotely.
9. Control over your data
Users can initiate data exports and account deletion.
Account deletion pageReport a security vulnerability
You can report security vulnerabilities by email.
destek@orbitcashflow.com