Security

Last updated 15 October 2026

How we protect your work

• Two-factor authentication (authenticator apps) with recovery codes; administrators can be required to use it.
• Single sign-on through Google and institutional identity providers (OpenID Connect and SAML 2.0).
• Server-side sessions you can review and sign out remotely; suspending an account ends all sessions immediately.
• Passwords hashed with bcrypt; account lockout after repeated failures; rate limits on sign-in and email.
• Protection against cross-site request forgery, clickjacking and content sniffing; strict security headers.
• LaTeX compiles in an isolated container with no network, a read-only file system and shell escape disabled.
• Secrets and third-party tokens encrypted at rest with AES-256-GCM; payments handled entirely by Stripe.
• An audit log of security-relevant events.

Reporting a vulnerability

Email support@origlots.com (subject “Security”) with steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access other people’s data. We do not take legal action against good-faith research that follows these rules.

Contact

Questions about this page: support@origlots.com · www.origtex.com