Security
Trust is the product, so the security model is public. Here's how Oritavo protects accounts and results.
Sessions and authentication
Passwords are hashed with bcrypt and never stored or logged in plain text. Sessions use short-lived signed tokens kept in an HttpOnly cookie — inaccessible to scripts in the browser — and signing out revokes outstanding tokens server-side, not just locally. Sign-in with Google or Yahoo uses the standard authorization-code flow; provider tokens are used once, server-to-server, and discarded.
Assessment integrity
Question and choice shuffling is fixed per attempt by a server-signed token, so answers can't be mapped across attempts or shared between students meaningfully. Time limits anchor to the first open of an attempt. Attempt cooldowns and rate limits blunt brute-force strategies, and rapid-retry patterns are flagged to instructors.
Application hardening
All traffic is HTTPS. The browser talks only to the web tier; the API accepts requests solely from it, authenticated by a shared secret. Responses carry a strict Content-Security-Policy and related headers. Uploaded images are verified at the byte level — a file merely named like an image is rejected. Sensitive endpoints are rate-limited per account and per address.
Study materials and AI generation
Uploaded PDFs and note photos are validated at the byte level before anything is stored — a file's declared type must match its actual content, and oversized uploads are rejected outright. Materials are read only to extract text and draft questions, sent to the configured AI provider for that single purpose, and never used to train any model. Every AI-drafted question lands in a private, unreviewed question bank; nothing generated becomes visible to a student, or promotable into a live assessment, until a person has reviewed it.
Billing and payment data
Oritavo never collects, transmits, or stores card details on its own servers — that's a permanent design choice, not a temporary gap. Real payment processing runs entirely on Stripe's own hosted Checkout page, which is verified with a signed webhook rather than trusted on its word. Until real billing is fully live, upgrading uses a placeholder checkout that clearly discloses this and, true to that disclosure, never reads or stores anything typed into its card fields.
Account linking
Signing in with Google or Yahoo can link to an existing password-based account with the same email — but only once that email's ownership is actually established. A password set before that point is never treated as trusted, and is cleared rather than left as a standing way into the account.
Reporting a vulnerability
Found something? Email security@oritavo.com with steps to reproduce. We read every report, we won't pursue good-faith research, and we credit fixes if you'd like.