Security & trust
Public signals in. Nothing of yours out.
Orlea watches what your competitors publish and keeps what you do with it to your workspace. This page lists what we do to make that true, and what we don't claim yet.
Our principles
Public information only
We read what any visitor can read: public pages, feeds, job boards, app listings and official registers. We never sign in to a competitor's site.
Your workspace is yours
Who you track, what you ask and what your team says stays inside your workspace, enforced on our servers on every request.
We say what we can't see
A page we couldn't reach or a site that blocks us is shown as exactly that, never as “no change”.
The details
How it works, line by line.
Your data
- Tenant isolation
- Every query for workspace data uses the workspace from your session. No request can name another workspace or person.
- Private questions
- Questions you ask the assistant are visible only to you, not to the rest of your workspace.
- Integration tokens encrypted
- Slack and HubSpot tokens are encrypted at rest with AES-256-GCM, each bound to its own workspace.
- Secrets stay out of code
- Keys and credentials come only from the environment and are never written to logs.
- Public status
- Whether the app, monitoring, email alerts, AI analysis and integrations are working is on our status page, from the service's own measurements every minute.
- Service status
- Exports
- Owners and admins can export all of a workspace's data as JSON and CSV at any time; download links expire after 7 days. Price comparisons also export as CSV, and battlecards copy as Markdown.
Access
- No passwords
- You sign in with a one-time email link that expires after 10 minutes, or with Google.
- Roles
- An owner, admins and members; admins manage members and integrations. An agency's client workspaces take read-only viewers, who change nothing.
- Invitations expire
- An invitation can be accepted for 7 days, and only within your plan's seats.
- Rate-limited sign-in
- Authentication requests are rate limited, so links can't be requested in bulk.
- Share links
- Random 24-byte tokens, stored only as a hash, scoped to one change, revocable at any time, and showing nothing about you.
- API keys
- Read-only and scoped to one workspace. Random 32-byte keys, shown once and stored only as a hash, rate limited, revocable at any time, and stopped when their maker is no longer an admin.
- Connected AI assistants
- Assistants sign in with OAuth 2.1 and PKCE: an admin approves read-only access to one workspace on Orlea's own consent screen. Tokens are short-lived, bound to Orlea's MCP server, stored only as hashes and rotated on every refresh; a replayed token disconnects the app. Admins see and disconnect them in Settings → API.
How we collect
- robots.txt first
- Every page, feed and listing is checked against the site's robots.txt before it is read.
- One read for everyone
- A page is read once, however many workspaces track it, so no request is tied to your company.
- Public internet only
- Requests to private or internal network addresses are refused, including after a redirect.
- No personal data from feeds
- We keep a short plain-text excerpt of each news or release item and never keep its author.
Integrations
- Signed webhooks
- Each delivery carries an HMAC-SHA256 signature with a timestamp, and payloads contain no personal data.
- Verified Slack requests
- Every request from Slack is signature-checked, and a Slack user acts only as the member with the same verified email.
- Payments through Link
- Plans are sold through Link, Stripe's checkout, which charges the card, handles VAT and sends receipts. Card details go to Stripe, never to us; we keep only the Stripe customer and subscription ids.
- No tracking cookies
- Neither this site nor the app sets advertising or analytics cookies, and there's no session recording. The app uses only the cookies sign-in needs.
Not claimed here: SOC 2 or ISO 27001 certification, penetration test reports, SSO/SAML, data residency, an uptime SLA, or retention and deletion terms. If your review needs any of them, ask us.
Responsible collection
A good guest on every site.
Competitive intelligence only works if the web stays open to it. We read the way we'd want our own site read.
Robots.txt is respected
A page that a site's robots.txt disallows is never read, and the dashboard says so.
We identify ourselves
When we read a site directly, our crawler sends its own named user agent with a link to who we are.
Polite by design
Scheduled checks run at most hourly per page, an unchanged feed costs the site almost nothing, and public registers are read at the pace they ask for.
Nothing behind a login
We don't sign in, pass paywalls or read accounts. History comes from public pages and the Internet Archive.
FAQ
Security questions
Do you read anything that isn't public?
No. We read public web pages, public feeds and job boards, app store listings and official registers such as SEC EDGAR and Companies House. We never sign in to a competitor's site.
Can a competitor tell that my company is tracking them?
Our requests come from our crawler, not from you, and a page is read once however many workspaces track it. Nothing in a request names your company.
What if a site blocks automated visitors?
Some sites turn away every automated visitor, whatever their robots.txt says. We read those pages through a fetch service, and still only when robots.txt allows it. When we can't read a page at all, the dashboard says so.
Who on my team can see what?
Everyone in a workspace sees its competitors and changes. Members triage and share, admins manage members and integrations, an agency's client viewers can't change anything, and questions you ask the assistant stay private to you.
Do you have SOC 2, SSO or a DPA?
We don't claim certifications or features we can't show you. Request a demo and bring your security questionnaire; we'll answer it line by line.
Be the first to know. Every time.
Pick your first competitors in a few clicks and see their last 90 days within minutes.