Security and data

Sessions use an httpOnly cookie with a random token. Only its SHA-256 is stored in the database: a copy of the database can't impersonate anyone. Changing the password invalidates open sessions.

Private routes check the session on the server. Mutations only accept trusted origins and sensitive APIs have rate limits.

• Passwords are stored with scrypt hashing, never in plain text.
• AI keys are stored encrypted and are not returned to the browser.
• The runner token is stored as a hash; the PC keeps it in its local data folder.
• The MetaTrader 5 bridge token lives in the local environment and doesn't travel to the browser.
• Stripe handles the payment. Oryon doesn't store card numbers.

• CSP with script-src-attr blocked, object-src none, frame-ancestors none and form-action self.
• X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin.
• HSTS with preload when the request arrives over HTTPS.
• API responses carry Cache-Control no-store so private data isn't left in intermediate caches.

See technical details in the documentation →

• You can export your strategies, deployments, history and following as JSON from Account. It doesn't include passwords, session tokens or private keys.
• You can delete your account and associated data; deletion cascades.
• Public profiles show only the display name, bio and the strategies you choose to publish. Never your email.
• Local execution with MetaTrader 5 happens from your PC, not from the web server.

If you find a security flaw, email us with steps to reproduce it. Don't publish third-party data or run denial-of-service tests.

oryon.help@outlook.com · security.txt

No system is invulnerable. Oryon reduces the attack surface and makes limits explicit, but it can't guarantee that a broker, a data provider or a browser extension behaves correctly.