Security

Access

• Only authorized users, with roles and scope defined per organization or journal (institutional administrator, editor, registry operator), can change records.
• Accounts are personal and confirmed by email; repeated failed sign-ins block new attempts for 15 minutes.
• Organizations and journals see and change only their own records.

Credentials for integrations

• Journals access the API with their own credentials, restricted to their journal and to the scopes they need, with expiry and revocation.
• Credential secrets are shown once and never stored in plain text.
• Webhooks to publishers are signed (HMAC-SHA256) and sent only to HTTPS addresses.

Audit

• Relevant actions are recorded in a hash-chained audit log that makes tampering detectable; its integrity is verified continuously (see System status).
• Logs do not store passwords, credentials or IP addresses in plain text.

Data protection

• All traffic uses HTTPS.
• Payment card data never reaches ORI: payments are processed by the payment provider, and only the payment status is kept.
• Secrets of external services are stored encrypted.
• Full texts are kept in private storage, outside the public web, with checksums and a second copy.
• The public API is rate-limited to protect the service.

Reporting a vulnerability

If you find a security issue, write to the ORI team through the Contact page with the details needed to reproduce it. Please do not disclose it publicly before it is fixed; we will acknowledge the report and keep you informed.

Continuity

• The registry is backed up regularly, and deposited files have a second copy that repairs damaged files.
• The state of the main services is shown live on the System status page, where incidents and maintenance are announced.