Security
The controls that exist, and where each one stops.
Each control below is followed by what it does not do: the key in your browser, the co-signer's rules, the encrypted channel, the signed releases and the checks on every payment.
The limit to know first
A browser is a weaker place for a key than the phone app.
A business in a browser is less protected than a user of the phone app.
For a few seconds per payout, your key is in a web page that Orrerie's server sends. On the phone app that code is inside a signed build that changes only when you install an update; in a browser it arrives on every visit.
If someone took over that page and Orrerie's co-signing server at the same time, they could take the money of every merchant who approved something while it lasted. Nothing technical stops that pair. The saved-address rule, the waits and the daily limits hold against either one alone.
No outside firm has reviewed Orrerie Merchant. Every part that touches keys or money ends with an in-house attack review.
Money out
Rules the co-signer keeps, whatever the page says.
- A fresh passkey signature for every movement. A copied browser key is useless without one.
- Saved addresses only. This rule is always on and cannot be switched off.
- A 24-hour wait on a new saved address, with an email to every owner and a link to cancel. The wait starts only once that email has been accepted for delivery.
- Daily limits. Payouts to other people follow your tier. Withdrawals to your own addresses follow a safety limit you set; lowering it is immediate and raising it takes 24 hours.
- A wait on any change of keys: 72 hours to replace the browser key and 7 days to replace the recovery key, unless the request carries the recovery key's own signature. Every owner is emailed during the wait and can cancel it.
- A freeze you can switch on. An Owner, Admin or Finance member can freeze all money out at once. Unfreezing needs an Owner's passkey and then 24 hours.
Where these stop
These rules are kept by Orrerie's co-signer. They hold against a stolen session or a replaced page. They do not hold against someone who controls both the page and the co-signer.
In transit
An encrypted channel on top of HTTPS.
Every call a dashboard or checkout page makes to Orrerie is encrypted in the browser, on top of HTTPS. A signed manifest starts the session, the browser makes a fresh key, and each request and answer is sealed and tied to its host, route, session and place in the sequence, so a captured message cannot be replayed, reordered or sent elsewhere. If the channel cannot be set up, the page says why and does nothing.
What it stops
A proxy, a corporate TLS inspector, a browser extension that reads network traffic or a logging content network cannot read or alter your data in transit. Scripted scraping and replay become much harder.
What it does not stop
It does not protect against the page's own code being replaced. Signed releases and the page's self-check are for that.
The developer API is ordinary JSON over HTTPS, protected by its key and by idempotency keys, so that any HTTP library can call it. Webhooks are signed with HMAC-SHA-256 so your server can verify them.
The code you are served
Signed, reproducible releases, and a page that checks itself.
- No third-party script anywhere on the dashboard or the checkout: no analytics, chat widget, font host or tag manager.
- Every script is named by its content and loaded with an integrity check, under a policy that allows no inline script and no eval.
- The build is reproducible: the same source gives the same bytes twice, and each release is signed with a key that is kept off the web server.
- The page checks itself. On load the dashboard compares the scripts it is running with the signed release and refuses to open your wallet key if they differ, with the reason on screen.
- The checkout cannot be framed by another site, so a fake page cannot draw its own buttons over a real checkout.
Where this stops
The scripts are made hard to read, which is friction for an attacker and not a secret: no key or check relies on it. A self-check run by a replaced page can be replaced with it, which is why a monitor outside Orrerie's servers also compares the served files with the signed release.
Paid, screening and reviews
Paid means your own wallet shows the money.
An order is Paid only on your own wallet's read of the network. A provider's word or a webhook is a hint. A timeout is treated as unknown, never as failed, and nothing is retried blind.
Payers' addresses are screened against sanctions lists, and so is the destination of a payout. Screening a payer happens after the money has arrived, so it can flag a payment but cannot prevent one. A screening check that fails to answer is treated as unavailable, never as clean.
Payers are never asked who they are. A business that wants higher limits passes a business check run by Didit.
Every part of the product that touches keys or money ends with an in-house attack review. No outside security firm has reviewed Orrerie Merchant.
The real addresses
Check the address bar.
| Address | What is there |
|---|---|
| merchant.orrerie.com | The dashboard and the docs. The only place a wallet key is ever unlocked. |
| pay.orrerie.com | Everything a payer sees: checkout, payment links, invoices, receipts. |
| api.orrerie.com | The developer API. No cookie ever reaches it. |
| recover.orrerie.com | The download page of the recovery tool. |
| wallet.orrerie.com | This website. |
| orrerie.com | The company's own domain. Every address on this list ends in it. |
Orrerie never asks for recovery words on a hosted page. A merchant types none there: its recovery key is made and kept by the Orrerie app on its phone, and is rebuilt from the app's backup words only in the downloaded recovery tool.
Tell Orrerie about a weakness through the vulnerability report page. Please leave wallet secrets out of your message.
Incidents
Incident write-ups.
A serious incident (severity 1 or 2) is written up within 5 working days, with its timeline, its cause and what changed, and published here.
None so farNo incident has been written up.
Every limit is on this page. Then start.
Sign-up is by invitation while we open in stages. Free to start.
The pictures on this page show the built product with a test business and simulated payments.