Security
Orla holds a record of your money, and sometimes the keys to it. That is a responsibility we design around from the start, not a feature we bolt on. Here is how it works.
Orla can't move your money on its own
This is the foundation. Connections to banks and exchanges are read-only. Wallet keys live in your browser, not on our servers. Anything that actually moves value is signed by you, and above a threshold you set, by a second person too.
Your keys stay with you
Create or import a wallet and the seed is encrypted in your browser. Only the public address reaches us. Sends are signed locally, with an AML check on the destination and an optional passkey confirmation. Because the keys are yours, we cannot recover them. That is the trade-off of real self-custody, and we would rather be honest about it than pretend otherwise.
Read-only by design
Bank connections use hosted open banking, so Orla never sees your banking password. An exchange API key is verified before it is stored and rejected outright if it can trade or withdraw. A key that stops working pauses its sync and tells you, rather than failing silently.
Getting in, safely
Sign in with a password (twelve characters minimum), Google, a passkey, your Ethereum wallet, or with two-factor authentication and single-use recovery codes. The last remaining sign-in method can't be removed, so no setting can lock you out. We email you when a password, 2FA or passkey changes, or when a new device signs in.
A record of what happened
Every device with access is listed and can be revoked. A personal security log shows sign-ins and changes. In shared spaces, an activity log keeps everyday and governed actions alike, with the old value beside the new one on every edit.
Under the hood
Passwords are hashed. Sensitive secrets are encrypted at rest. Sessions use short-lived tokens with the refresh token in a secure, http-only cookie. The database is firewalled to the application. The site sends strict security headers.
Found something?
If you believe you have found a security issue, tell us at [email protected] before disclosing it publicly, and we will work with you on it.