Security

• Documents are encrypted at rest (AES) and in transit (TLS 1.2+).
• Two-step sign-in is available to everyone and can be required for administrators.
• Every access to another person's report is recorded in a tamper-evident audit log.
• Reports carry a watermark and a verification code; anyone can check a code at /verify.
• Our controls are mapped to ISO/IEC 27001:2022, SOC 2, the NIST Cybersecurity Framework 2.0, the CIS Controls v8 and the OWASP ASVS; dependencies, containers and infrastructure are scanned on every change.
• You choose the hosting region; data stays there.

Reporting a vulnerability: please email the support team at support[at]origlots[dot]com. We acknowledge reports within 3 working days and will not take action against good-faith research that respects our users' privacy.