Credential and Password Security

Last Modified: December 2, 2025

OrgOrg's credential management system is built with multiple layers of security to protect your sensitive login information. We employ industry-leading encryption and access control mechanisms to ensure your credentials remain secure at all times.

Encryption at Every Layer

All credentials stored in OrgOrg are encrypted using AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode), the same encryption standard used by government agencies and financial institutions worldwide. This provides:

  • 256-bit encryption keys - One of the strongest encryption standards available
  • Unique initialization vectors (IV) - Each credential is encrypted with a unique random IV, ensuring that identical passwords produce different encrypted outputs
  • Authentication tags - Built-in tamper detection that prevents unauthorized modification of encrypted data
  • No plain text storage - Your passwords are never stored in a readable format

Server-Side Only Decryption

One of the most important security features of OrgOrg's credential system is that passwords are never decrypted in your browser or on your device. All decryption operations happen exclusively on our secure servers.

This means:

  • Encryption keys never leave our protected infrastructure
  • Decrypted passwords are never transmitted to or stored on client devices
  • The attack surface is significantly reduced - client-side vulnerabilities cannot expose your passwords
  • Even if your device is compromised, attackers cannot access your encrypted credentials without our encryption keys

Granular Access Control

Every credential in OrgOrg has configurable access controls that determine who can view and use it. Access control is enforced at the database level and verified on every request. Available permission levels include:

  • Only Me - Private credentials visible only to you
  • Specific People - Share with selected team members
  • Roster - Available to members of a specific team or roster
  • Organization-Wide - Accessible to all members of your organization
  • Link Sharing - Accessible via shareable link (with organization authentication still required)

Access permissions are checked on every operation, ensuring that only authorized users can view, edit, or delete credentials.

Comprehensive Audit Logging

OrgOrg maintains detailed audit logs of all credential access events to help you monitor usage and detect unauthorized access. We track:

  • Who accessed the credential (user identity)
  • When it was accessed (timestamp)
  • What action was performed (view, copy, or open & copy)

Audit logs are available directly in the OrgOrg interface, allowing credential owners to review access history and identify any suspicious activity. These logs are tamper-proof and stored separately from the credentials themselves.

Secure Key Management

The encryption keys that protect your credentials are managed using industry best practices:

  • Keys are stored separately from encrypted data in secure environment variables
  • Keys are never stored in source code or version control systems
  • Access to encryption keys is strictly limited to authorized systems
  • Keys are protected by additional layers of access control and monitoring

Data Isolation

Every credential is associated with a specific organization, and data isolation is enforced at multiple levels:

  • Organization ID is required and validated on every database query
  • Users can only access credentials belonging to their organization
  • Authentication tokens are validated before any credential operation

Network Security

All communication between your browser and OrgOrg's servers is protected by multiple layers of security:

  • TLS 1.3 encryption with 256-bit keys protects data in transit
  • HTTPS-only connections - No unencrypted HTTP traffic is allowed
  • Content Security Policy prevents cross-site scripting attacks
  • CORS policies restrict which domains can access our APIs
  • Security headers protect against common web vulnerabilities

Authentication and Authorization

Before any credential can be accessed, OrgOrg verifies both authentication (who you are) and authorization (what you're allowed to do):

  • Google OAuth integration ensures secure, standards-based authentication
  • Session tokens are validated on every request to our servers
  • Authorization checks verify that you have permission to access each specific credential
  • Two-factor authentication (2FA) is supported through Google accounts

Best Practices for Users

To maximize the security of your credentials in OrgOrg, we recommend following these best practices:

  • Enable two-factor authentication on your Google account and all services where you store credentials
  • Use unique, complex passwords for each service - avoid reusing passwords
  • Review access logs regularly to monitor for unusual activity
  • Apply the principle of least privilege - share credentials only with team members who genuinely need access
  • Remove access promptly when team members change roles or leave the organization
  • Use appropriate access levels - prefer "Specific People" or "Roster" over "Organization-Wide" when possible
  • Rotate shared credentials when team members with access depart

Incident Response

In the unlikely event of a suspected security incident involving credentials, OrgOrg's security team follows established incident response procedures:

  • Immediate investigation - Our security team investigates all reported incidents promptly
  • Containment - We take immediate action to contain any potential breach
  • User notification - Affected users are notified according to our incident response policy
  • Remediation - Additional security measures are implemented as needed
  • Post-incident review - We conduct thorough reviews to prevent future incidents

We maintain 24/7 monitoring of our systems to detect and respond to security events in real-time.

Compliance and Standards

OrgOrg's credential security practices align with industry standards and compliance frameworks:

  • SOC 2 Type II compliance principles
  • GDPR data protection requirements
  • Industry best practices for password management
  • OWASP security guidelines

Questions or Concerns?

If you have questions about how OrgOrg protects your credentials, or if you believe you've discovered a security issue, please contact our security team:

For more information about OrgOrg's overall security practices, please see our Security page.