Security

Last updated 3 September 2026

How OriginStat is built to protect an account, and how to tell us when we have got something wrong.

Accounts

• Passwords are stored as PBKDF2-SHA256 at 600,000 iterations with a random per-user salt. We never see or store the password itself.
• A sign-in that names an unknown address does the same work as one that names a real one, so the response time cannot be used to discover who has an account.
• Two-factor authentication is available on every plan, with single-use recovery codes. A session that has passed the password but not the second factor is not a signed-in session.
• Sign-in, sign-up and recovery are rate limited by address and by account, counted exactly rather than approximately.
• Sessions are httpOnly, SameSite cookies, and changing your password ends every other session.

Your data

• A read-only key you connect for revenue attribution is encrypted with AES-GCM before it is stored, under a secret kept separately from the one that signs sessions, with a fresh IV per record. The dashboard only ever shows a masked fragment. A database dump on its own does not yield a working key.
• Every site query is scoped to the account that owns it. A site key works only on the domain it was issued for.
• Each request that changes something must state where it came from, and one that names another site is refused.

Visitors

• No cookies are set, and no IP address or user agent string is ever written down.
• The identifier separating one visitor from another is a truncated hash of a secret, the date, the site and the connection. Because the date is an input, it cannot link a visitor across two days; because the site is an input, it cannot link one across two sites.
• Text arriving from a link — a campaign name, a referrer — is stripped of markup at the point of storage, not merely escaped on the way out, so a value cannot become an injection in an email we send you later.

Honest limits

Worth writing down, because a security page that lists only strengths is not much use:

• Ingest rate limiting is approximate. It is counted per edge isolate rather than globally, because an exact count would cost more per event than the event is worth. It bounds abuse; it does not eliminate it.
• Rate limiters fail open. If the limiter itself breaks, requests are allowed rather than refused — we would rather slow an attacker than lock you out of your own dashboard.
• We rely on our host for physical security, at-rest encryption and network isolation. We are as good as they are on those, and no better.
• There is no independent audit or SOC 2 report. If you need one to buy, say so and we will tell you honestly where we are.

Contact

support@originstat.com — also published at /.well-known/security.txt.