Security Policy

OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we", "us", or "our") treats the security, confidentiality, and integrity of your Account and research manuscripts as a foundational engineering priority. This Security Policy describes the technical and organisational security practices we maintain in compliance with Section 8(5) of the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and international security standards (including GDPR Article 32). This Policy forms part of our Privacy Policy and Terms of Service.

1. Account & Authentication Security

2. Application, Network & Data Security

2.1 Encryption in Transit and at Rest.

• In Transit: All traffic between your browser and orbitsub.com, our real-time WebSocket servers (Live Rooms), and our external API sub-processors is encrypted using TLS 1.2 / TLS 1.3 with HTTP Strict Transport Security (HSTS) enforced in production.
• At Rest: Production relational databases (PostgreSQL), cache stores (Redis), and object storage buckets (Cloudflare R2 holding uploaded PDFs and avatar/cover assets) are encrypted at rest using industry-standard AES-256 encryption managed by our infrastructure providers.

2.2 Input Validation & Web Security Headers.

• Every API endpoint enforces strict schema validation (via Zod) to reject malformed payloads, prototype pollution, and injection attempts.
• Rich-text HTML and Markdown inputs are sanitised to prevent Cross-Site Scripting (XSS).
• Responses are served with hardened HTTP security headers, including Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and strict Referrer-Policy rules.
• File uploads are validated against strict size caps and binary magic-byte / MIME signatures before storage.

2.3 Real-Time Collaboration & Document Isolation.

• Access to private research manuscripts, Reference Libraries, and Orbit AI histories is enforced at the database query layer by ownership and explicit collaborator permission checks.
• Live Room WebSocket connections require cryptographic authentication or a valid room access code and respect document-level role permissions (Owner, Editor, or Viewer) and section locks.

2.4 Payment & Webhook Verification.

• All billing transactions are handled by PayPal.
• Incoming PayPal webhooks are cryptographically verified against PayPal's verification API (verify-webhook-signature) and processed idempotently (ProcessedWebhookEvent) with database-level concurrency locks to prevent replay attacks or double-billing.

2.5 Operational Monitoring, Health Checks & Backups.

• We continuously monitor platform availability and latency (visible publicly at /status), track unhandled exceptions using privacy-scrubbed error telemetry, and maintain automated database backups to support disaster recovery.

3. Organisational Access Controls & Sub-Processors

1. Least-Privilege Access: Administrative access to production infrastructure and databases is restricted to the proprietor/authorised engineering personnel using multi-factor authentication and encrypted SSH/TLS channels.
2. Audit Logging: Administrative and moderation actions are recorded in immutable internal audit logs (AdminAuditLog).
3. Sub-Processor Vetting: We rely exclusively on established cloud, database, storage, email, and AI model providers bound by data processing agreements, confidentiality obligations, and zero-training clauses (see our Privacy Policy).

4. Security Incident Response & Breach Notification

We maintain an incident response workflow to detect, contain, investigate, and remediate security incidents rapidly. In the event of a confirmed personal data breach or cybersecurity incident, we act in accordance with applicable statutory timelines:

5. How You Can Keep Your Account Safe

Security is a shared responsibility. We strongly recommend that you:

1. Use a Strong, Unique Password: Choose a password of at least 12 characters (or a password manager passphrase) that you do not reuse on any other website.
2. Enable Two-Factor Authentication (2FA): Turn on TOTP 2FA in Settings → Security and store your single-use recovery backup codes in a secure offline location.
3. Guard Against Phishing: Official emails from us originate only from our orbitsub.com domain. We will never ask you for your password or 2FA code by email or Direct Message.
4. Review Active Sessions: Periodically check Settings → Security and revoke any unrecognised device sessions.
5. Protect Live Room Codes: Share private Live Room codes only with trusted collaborators.
6. Report Suspicious Activity Immediately: If you suspect unauthorised access to your Account, change your password immediately, revoke all active sessions in Settings → Security, and email team@orbitsub.com with the subject line Urgent Account Security.

6. Vulnerability Reporting

If you are a security researcher or user who has discovered a potential security vulnerability in OrbitSub, please report it responsibly under our Responsible Disclosure Policy.

7. Responsible Security Disclaimer

While we implement defence-in-depth engineering controls and industry-standard encryption, no method of transmission over the internet or electronic storage is 100% impervious to sophisticated attacks. We continuously review and upgrade our security posture as threats evolve.

This Policy is effective from 1 October 2026 and was last updated on 25 October 2026.