Security
A factual overview of account and payment protections, and how to report a security concern.
Account access
Google, personal Microsoft or LinkedIn accounts can be used to create and access your account. We request basic identity permissions (openid, email and profile), without access to mail, calendars or files. Open Role View does not provide a separate password login.
Sessions and requests
Production configuration requires a secure sign-in cookie. It is HttpOnly and uses SameSite=Lax. Sessions have an expiry; the default is 30 days. Cookie-authenticated requests that change data require a CSRF token and an accepted origin.
Payments
Payment details are entered on Stripe’s hosted checkout. Open Role View records payment references and status to manage access rather than receiving card-entry fields.
Report a security issue
Contact us with enough information to investigate a suspected issue. Do not include passwords, bearer tokens or payment-card details.