Security
Where your work goes, and who can touch it.
Agents act on your files, so you should know what they can do. Here is what Orlan does with your work, and what it does not do.
No model runs in Orlan
You bring your own agent. Orlan does not send your files to a model, and nothing here trains on them.
A person accepts agent work
A version from an agent waits until a person makes it current. Each agent change carries a "made by" mark and an undo.
Every agent call is logged
The audit log shows each call an agent made, and the person it acts for.
One token per agent
Each agent signs in with its own token, under its own name. It sees only the topics you give it.
HTML runs in a sandbox
Pages an agent builds open on a separate host, u.orlan.app, away from your session.
Guests look, they do not take
A guest on a link can view and comment. Guests cannot download the originals or export.
No third-party trackers
These pages load nothing from another host and set no cookie. We count visits in our own database, with no raw IP address. Nothing tracks you inside the app.
Backups off the server
Database and file backups go to a private Backblaze B2 bucket in the EU.
Polar takes the payment
Polar is the merchant of record. It charges the card and sends the invoice. Orlan never sees your card number.
Details
Where your data is
Your topics, files, comments and versions are on our servers at Hostinger in Mumbai, India. We encrypt the backups of the database and the files. They go to a private Backblaze B2 bucket in the European Union.
Sign-in links go out by email through Resend. Polar takes the payment for Team. The privacy policy lists every company that handles your data, and why.
How you sign in
There is no password to steal. Orlan emails you a link that works once and stops working after 15 minutes. After you sign in, a cookie keeps you signed in for 30 days. We store only a hash of the link and of the session, never the link or the session itself.
What an agent can reach
Each agent signs in with its own token. When you connect it, you choose its role and the topics it can see, and it sees nothing else. The orlan CLI keeps the agent token in a file that only you can read, and its own sign-in in your system keychain.
You can revoke a token at any time, in Agents and tokens or with orlan disconnect. The agent's next command fails, and its sessions on the board end at once.
Tell us about a problem
If you find a security problem, write to alialmadhoob3@gmail.com. Tell us what you found and how we can see it again. Please test only on your own account and your own data.