Security & Trust
Public Signals In. Nothing Of Yours Out.
Orlea watches what your competitors publish and keeps what you do with it to your workspace. This page lists what we do to make that true, and what we don't claim yet.
Our Principles
Public Information Only
We read what any visitor can read: public pages, feeds, job boards, app listings and official registers. We never sign in to a competitor's site.
Your Workspace Is Yours
Who you track, what you ask and what your team says stays inside your workspace, enforced on our servers on every request.
We Say What We Can't See
A page we couldn't reach or a site that blocks us is shown as exactly that, never as “no change”.
The Details
How It Works, Line By Line.
Your Data
- Tenant isolation
- Every query for workspace data uses the workspace from your session. No request can name another workspace or person.
- Private questions
- Questions you ask the assistant are visible only to you, not to the rest of your workspace.
- Integration tokens encrypted
- Slack and HubSpot tokens are encrypted at rest with AES-256-GCM, each bound to its own workspace.
- Secrets stay out of code
- Keys and credentials come only from the environment and are never written to logs.
- Exports
- Price comparisons export as CSV, and battlecards copy as Markdown.
Access
- No passwords
- You sign in with a one-time email link that expires after 10 minutes, or with Google.
- Roles
- Owners, admins, members and viewers. Viewers read everything in their workspace and change nothing.
- Invitations expire
- An invitation can be accepted for 7 days, and only within your plan's seats.
- Rate-limited sign-in
- Authentication requests are rate limited, so links can't be requested in bulk.
- Share links
- Random 32-byte tokens, stored only as a hash, scoped to one dashboard or change, revocable at any time, and showing nothing about you.
How We Collect
- robots.txt first
- Every page, feed and listing is checked against the site's robots.txt before it is read.
- One read for everyone
- A page is read once, however many workspaces track it, so no request is tied to your company.
- Public internet only
- Requests to private or internal network addresses are refused, including after a redirect.
- No personal data from feeds
- We keep a short plain-text excerpt of each news or release item and never keep its author.
Integrations
- Signed webhooks
- Each delivery carries an HMAC-SHA256 signature with a timestamp, and payloads contain no personal data.
- Verified Slack requests
- Every request from Slack is signature-checked, and a Slack user acts only as the member with the same verified email.
- Payments by Stripe
- Checkout and billing run on Stripe; card details are entered with Stripe, not with us.
- Cookieless product analytics
- Usage events carry ids and counts only, never names, emails or text you typed. No session recording, and nothing stored in your browser.
Not claimed here: SOC 2 or ISO 27001 certification, penetration test reports, SSO/SAML, data residency, an uptime SLA, or retention and deletion terms. If your review needs any of them,ask us.
Responsible Collection
A Good Guest On Every Site.
Competitive intelligence only works if the web stays open to it. We read the way we'd want our own site read.
Robots.txt Is Respected
A page that a site's robots.txt disallows is never read, and the dashboard says so.
We Identify Ourselves
When we read a site directly, our crawler sends its own named user agent with a link to who we are.
Polite By Design
Scheduled checks run at most hourly per page, an unchanged feed costs the site almost nothing, and public registers are read at the pace they ask for.
Nothing Behind A Login
We don't sign in, pass paywalls or read accounts. History comes from public pages and the Internet Archive.
FAQ
Security Questions
Do you read anything that isn't public?
No. We read public web pages, public feeds and job boards, app store listings and official registers such as SEC EDGAR and Companies House. We never sign in to a competitor's site.
Can a competitor tell that my company is tracking them?
Our requests come from our crawler, not from you, and a page is read once however many workspaces track it. Nothing in a request names your company.
What if a site blocks automated visitors?
Some sites turn away every automated visitor, whatever their robots.txt says. We read those pages through a fetch service, and still only when robots.txt allows it. When we can't read a page at all, the dashboard says so.
Who on my team can see what?
Everyone in a workspace sees its competitors and changes. Viewers can't change anything, admins manage members and integrations, and questions you ask the assistant stay private to you.
Do you have SOC 2, SSO or a DPA?
We don't claim certifications or features we can't show you. Book a demo and bring your security questionnaire; we'll answer it line by line.
Be The First To Know. Every Time.
Add your first competitors in under a minute and see their last 90 days today.