What we hold. What we cannot see.
OC Vault encrypts every item in your browser. So a new device can unlock, your vault key is also stored with us, sealed under your passphrase and your recovery code — ciphertext we cannot open. A compromise of OrangeCheck exposes encrypted blobs, not your secrets; a weak passphrase you chose yourself is the one thing an attacker holding them could try to guess offline.
- >>your orangecheck account id (a random did:oc), which your vault is filed under
- >>your vault key, sealed under your passphrase and under your recovery code — ciphertext we cannot open without one of them
- >>for paid tiers: the BTCPay invoice id, sats paid, tier, and entitlement expiry
- >>an opaque, double-encrypted blob per item — your synced vault, as ciphertext
- >>one row per item, carrying its opaque id and a last-updated timestamp — so we can see how many items you store and when each last changed. The count enforces the per-account item ceiling; the timestamp tells a second device what to re-sync
- >>request metadata (IP, timestamps) for rate limiting — counters expire with their window, and request logs stay only in our hosting provider's own short retention
- ×the contents of any vault item
- ×the names, titles, or types of your items
- ×your vault passphrase or recovery code — neither is ever sent to us
!! the encryption design that prevents OrangeCheck from reading your data also prevents OrangeCheck from recovering it. If you lose your vault key and all recovery factors, your data is permanently unrecoverable. Keep your own backups of anything critical.
responsible disclosure
Email security@ochk.io — use PGP for highly sensitive findings; the fingerprint and key are published at github.com/orangecheck/.github/SECURITY.md. Alternatively, open a private GitHub security advisory on the most relevant orangecheck/* repository.
- acknowledgementwithin 72 hours of receipt
- triagewithin 7 days — whether we agree it is a vulnerability, the severity assigned, and a target fix date
- coordinated disclosurewe credit you (unless you prefer anonymity) and publish an advisory once the fix ships
- bountyno paid bounty program yet — the ecosystem is young; we are grateful for responsible disclosure