Orlivas — Security & Responsible Disclosure
Version 1.0.0 · Effective 2026-07-11 · Last updated 2026-07-11
Orlivas stores sensitive health data, so security is fundamental. This page summarizes
how we protect data and how to report a vulnerability responsibly.
1. How we protect your data
- Encryption in transit: all traffic uses TLS.
- Authentication: passwords are hashed with bcrypt; sessions use short-lived signed
access tokens (15 minutes) with rotating refresh tokens (30 days) that are revoked on
logout and account closure. Sign-in with Google and Apple is verified against the
provider's published keys.
- Access control: access to member health data is enforced **server-side by family
role on every request**; a small operations team can access data only when strictly
necessary, under confidentiality duties, with actions audit-logged.
- Abuse protection: login throttling and lockout, and rate limiting on sensitive
endpoints.
- File handling: uploads are validated and stored outside the web root; files are
served only to authenticated family members.
- Secrets & backups: production secrets are kept out of source; the app refuses to
boot with development secrets in production. Databases are backed up encrypted with a
14-day rolling retention and tested restore procedures.
- Data minimization for third parties: push payloads carry only notification text and
routing ids; our billing processor receives only a user id and purchase state; crash
reporting excludes personal identifiers and health data.
2. Reporting a vulnerability
If you believe you have found a security vulnerability, please tell us before disclosing
it publicly. Email security@zagru.com with:
- a description of the issue and its potential impact,
- steps to reproduce (proof-of-concept), and
- any relevant logs, requests or screenshots.
Please use a secure channel and avoid sharing real users' personal or health data in your
report.
3. Our commitments
- We will acknowledge your report, investigate, and keep you informed of progress.
- We will not pursue legal action against good-faith research that follows this policy.
- We will credit you if you wish, once an issue is resolved.
4. Please do (and don't)
Do: test only against your own accounts/data; report promptly; give us reasonable
time to fix before public disclosure.
Don't: access, modify or delete other people's data; degrade the service (no DoS,
spam or social engineering); run automated scans that harm availability.
5. Scope
In scope: the Orlivas mobile apps, backend APIs, orlivas.com, and the management
console. Out of scope: third-party services (app stores, hosting, push providers) — report
those to the respective provider.
6. Data-breach handling
If a confidentiality incident presents a risk to your rights, we will notify affected
users and the competent supervisory authority as required by applicable law (e.g. GDPR,
Québec Law 25, KVKK) without undue delay.
7. Contact
Security / responsible disclosure: security@zagru.com
(A product-specific security@orlivas.com alias may be published later.)