Orthogonal Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://www.orthogonal.com/security
policy:
- https://www.orthogonal.com/security
contact:
- security@orthogonal.com
program:
  type: responsible-disclosure
  bug_bounty: false
  platform: null
  paid: false
  note: >-
    Section 8 "Responsible Disclosure" of the Security & Trust page (last updated
    2026-06-15) invites reports from security researchers and users to
    security@orthogonal.com with enough detail to reproduce. No bug bounty, no
    HackerOne/Bugcrowd/Intigriti program, no published safe-harbour language, no
    stated response SLA — the commitment is to "acknowledge legitimate reports
    and work to address confirmed issues promptly".
  researcher_expectations:
  - give a reasonable opportunity to investigate and remediate before public disclosure
  - do not access or modify data that is not your own
  - do not degrade or disrupt the Services or other users while testing
security_txt:
  published: false
  note: >-
    No RFC 9116 /.well-known/security.txt on any host (api, mcp, docs all 404;
    apex 307s). The disclosure policy is discoverable only by a human reading the
    website — the machine-readable path is unpublished, so no SecurityTxt pointer
    is emitted.
practices_published:
  url: https://www.orthogonal.com/security
  last_updated: '2026-06-15'
  legal_entity: Orth Inc., dba Orthogonal
  covers:
  - TLS/HTTPS encryption in transit, to clients and to upstream providers
  - encryption at rest for credentials and account information
  - least-privilege access controls on production systems
  - data minimisation — call metadata logged for billing; request/response bodies not logged without consent
  - API key create/revoke/rotate from the dashboard
  - card data handled by a third-party processor; no full PANs stored
  certifications: []
  certifications_note: >-
    Prose only. No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP is claimed, and no
    trust center exists (trust.orthogonal.com returns 404). No Compliance or
    TrustCenter pointer is emitted.
evidence:
- source: https://www.orthogonal.com/security
  http_status: 200
  kind: disclosure page
  keywords:
  - responsible disclosure
  - security vulnerability
  - security researchers
  - security@orthogonal.com
- source: https://trust.orthogonal.com
  http_status: 404
  kind: trust center probe (miss)
- source: https://www.orthogonal.com/.well-known/security.txt
  http_status: 307
  kind: security.txt probe (miss)
checked: '2026-08-14'