Security

If you believe you found a vulnerability, contact security@vorthra.com with steps to reproduce, affected URLs or endpoints, potential impact, and safe proof-of-concept details.

Do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and remediate it.

Vorthra is designed around tenant-scoped organization access. Business resources belong to organizations, and access is checked through active membership, role, plan, and feature gates.

• Authenticated user sessions.
• Organization memberships and roles.
• Plan-gated feature access.
• API key scopes.
• Public-only projections for public Vorthra Records.
• Audit logs for sensitive organization actions.

Vorthra uses Better Auth for passwordless magic-link sign-in, Google OAuth when configured, session cookies, and short-lived JWT support for applicable authentication flows.

Magic-link tokens are stored hashed, expire quickly, and are designed to be used once. Current session behavior uses a 7-day session lifetime with periodic session updates.

API keys are intended for machine access and should be treated like secrets.

• Raw API keys are generated and shown once.
• Stored API keys are HMAC-hashed.
• API keys have a visible prefix for identification.
• Scopes may include records:read and records:write.
• Keys may be revoked or configured with expiry dates.
• Last-used timestamps may be recorded.

Public Vorthra Records are intentionally public, but they use a restricted projection. Public pages may expose the Vorthra Record ID, recorded timestamp, SHA-256 hash, source title, verified person display name, organization display name, rights holder, and related public metadata.

Public records are designed not to expose internal record IDs, organization IDs, author email, billing fields, membership details, R2 bucket names, R2 object keys, or original uploaded file contents.

A Vorthra Record proves that a verified person created a Digital Record for a specific version of a file at a recorded point in time. A Vorthra Record does not prove authorship, factual truth, legality, who physically created the content, official status, copyright ownership, license scope, consent validity, or legal enforceability.

• Do not access, modify, delete, or exfiltrate data that is not yours.
• Do not disrupt Vorthra services.
• Do not perform social engineering.
• Do not perform destructive testing.
• Report security issues privately before public disclosure.