Security

Website protections

• HTTPS delivery through Netlify, with security headers that restrict scripts, framing, and browser capabilities.
• A server-side request endpoint that validates the request origin, content type, body size, and field limits.
• Cloudflare Turnstile verification before a message is stored, including checks of token validity, hostname, action, and age.
• Rate limiting and a honeypot field to reduce automated abuse.
• Private message storage accessible through authorized Netlify account access, with no public endpoint for listing or reading submissions.
• Daily cleanup of contact records older than 90 days. The application does not log form contents or verification secrets.

What this does not certify

This is the public website, not the authenticated Orpheus application. It does not accept customer workspace data or payments. Bot protection does not verify a submitter’s identity and cannot eliminate all abuse.

This page does not claim SOC 2 certification, ISO 27001 certification, HIPAA suitability, a completed penetration test, or a contractual uptime guarantee. Product authentication, tenant isolation, recovery, and service commitments require separate verification before customer launch.

Report a security concern

Use our contact form and begin your message with “Security report”. Include the affected URL, steps to reproduce, and likely impact. Send the minimum evidence needed; omit credentials, unrelated personal information, and customer data.

Please avoid disruptive tests, bulk automated scans, data extraction, or public disclosure of private information. Do not test infrastructure belonging to Netlify, Cloudflare, or other providers without their authorization. We will review reports, but do not currently offer a bug-bounty program or a guaranteed response time.