Trust each request. Control each credential.

Verify at the boundary

Configure separate provider credentials for Stripe, Paddle, GitHub, Shopify, or the ShellOrbit signature format. Verification uses the original request bytes. Choose quarantine to retain invalid requests without delivering them, or explicitly select observation mode to record failures while forwarding.

Provider verification is available on every plan. IP allowlisting is an additional Business control; it is not a replacement for signature verification.

Sign outbound deliveries

ShellOrbit signs outbound requests with an endpoint-specific key. Administrators can rotate it from endpoint settings. Copy the new key when it is shown, then update your destination. A 24-hour overlap allows both signatures during the transition.

Do not reuse provider secrets as your ShellOrbit signing key. Read the signature guide for the header format and verification examples.

Protect account access

Enable multifactor authentication. Use scoped API keys for server-side integrations and keep them out of browser code. Organization membership is checked on authenticated requests so removed members lose access.

Understand retention

Raw payloads can contain personal data. Choose the plan and workflow that match what you need to retain. Bookmarks expire with their events. Test fixtures require explicit review and have a separate, limited retention period.

Transport uses HTTPS. Infrastructure provisions encryption for stored event data. These controls are not a claim of independent certification. Review the privacy policy, DPA, and subprocessors for the contractual detail.

Report a concern

Use our responsible disclosure process. We recognize qualifying reports in the Hall of Fame, including the researchers who help improve account and application security.