Keep your
store behind
more than
a password.

Every account adds two-factor authentication within 14 days, or the dashboard stops at the door. The audit log names who changed what, and card numbers never reach our servers.

Start for free14 days free, no card
Read the DPA

Passkeys and two-factor on every plan, from £25 a month.

Enterprise-grade sign-in

Passkeys and two-factor on every plan

Account recovery built in

Ten backup codes, each used once

  • Passkeys or authenticator apps
  • Second factor required within 14 days
  • Hosted on AWS in London
  • Card numbers never stored

Two-factor on every account

Enforced within 14 days of first sign-in

Pick the second lock that suits you.

Passkeys, authenticator apps and text-message codes all work, and a passkey can sit alongside a code method. Skip it for 14 days and the dashboard stops asking nicely.

Passkeys

After your password, confirm the sign-in with a fingerprint, your face or a device PIN, from this device or your password manager. No six-digit code to type or hand over. Register as many as you like and name each one after the device.

App or text code

Google Authenticator, Authy or any authenticator app, or a six-digit code by text message. Choose one, and it can back up a passkey.

Ten backup codes

Eight characters each, each used once, stored hashed. Copy them or download the file, and once an authenticator app is set up you can regenerate the set with your password.

Trusted browsers

Tick “trust this device” on the code step and that browser skips the second factor for 30 days. Revoke one, or all of them, from Settings > Security Settings.

Start for free

Role-based permissions

One switch per action, by role or person

Give staff only what the job needs.

Start from one of seven roles, or build your own. Every role has permissions it always holds, ones you switch on per person, and ones it can never have.

Seven ready-made roles

Store Owner, Store Administrator and Store Staff, plus Fulfilment, Customer Support, Marketing and Catalogue Manager, each cut to one job.

One switch per action

Issue refunds and Manage product pricing are separate permissions, so support can refund an order without ever touching a price.

Restricted, with the reason

A permission a role cannot hold is listed under Restricted Permissions with the reason, instead of a greyed-out button nobody can explain.

Access ends at once

Remove someone and their store access ends on their next request. Their account, their history and everything they made stay where they are.

See team roles

The locks that turn themselves.

Six things that happen to every account without anyone opening Settings.

The 14-day countdown

Every account without a second factor is asked at first sign-in, reminded with a countdown in the dashboard, and stopped at the door once the 14 days are up.

Trusted browsers expire

A browser you trust skips the code for 30 days, then asks again. Only a hash of the trust token is stored, so a copied database cannot mint one.

Wrong passwords hit a wall

Sign-in is limited to 10 attempts a minute, and six wrong passwords from one place put that sign-in behind a password reset.

A new password signs everything out

Change or reset your password and every session ends on every device, and each trusted browser has to pass the second factor again. Turning two-factor off revokes trusted browsers too.

The log tidies itself

Store activity is kept 180 days; user, role, permission and security events two years. A job runs every night at 3am and deletes what is past its window.

Certificates without a ticket

Add a custom domain and point it at Orbit, and its HTTPS certificate is issued and renewed for you, with no extra DNS record to add for it.

Who changed the price, and when.

For the buyer doing due diligence. Every chip is a limit, a setting or a field in the product today.

Activity log

Every change in the store, with a name on it.

Orders, products, prices, discounts, gift cards, customers, settings, team changes, API keys and webhooks are written to Settings > Activity Log with who did it, what changed and when. Filter by actor, action, record type, person or date, search it, and export up to 10,000 rows as CSV. Store activity is kept 180 days; user, role, permission and security events two years. Store owners and store administrators open it.

  • Filter by person
  • Filter by action
  • Filter by record type
  • Date range and search
  • CSV up to 10,000 rows
  • Store activity kept 180 days
  • Security events kept 2 years
  • Support access marked

Passwords and secrets

Hashed or encrypted before they are stored.

Passwords are 8 to 128 characters with upper and lower case, a number and a symbol, hashed with bcrypt. Authenticator secrets, courier and manual-payment credentials and supplier feed passwords are encrypted with AES-⁠256-⁠GCM under keys derived with scrypt. Changing a password needs the current one, and a new email address takes effect only after you click the link sent to it.

  • bcrypt
  • 8 to 128 characters
  • AES-256-GCM
  • scrypt keys
  • Current password to change
  • New email verified first

Sign-in limits

Slow down anyone guessing.

The six wrong passwords are counted for each email and IP address pair over an hour, so only the source doing the guessing is sent to a reset. Every failed sign-in is logged on our side and kept two years.

  • 10 sign-ins a minute
  • 5 reset requests a minute
  • 6 wrong passwords, then a reset
  • Failed sign-ins logged

API keys and webhooks

Shown once, scoped, revocable.

A key is shown once and only its SHA-⁠256 fingerprint is kept. Pick the scopes it may call, set an expiry or leave it open, and revoke it in one click. Webhook deliveries go to HTTPS endpoints only and carry an HMAC-⁠SHA256 signature in the X-⁠Orbit-⁠Webhook-⁠Signature header.

  • Scoped
  • SHA-256 fingerprint
  • Optional expiry
  • Revoke at once
  • HTTPS only
  • HMAC-SHA256

Hosting and payments

Enterprise-grade, from server to checkout.

The platform runs on AWS in the London region, with Ireland also named on the sub-⁠processor list. Every storefront is served over HTTPS, and a custom domain gets its own certificate once it points at Orbit. Orbit Payments takes the card on a PCI DSS Level 1 certified payment page, so a card number never touches your store or our servers.

  • AWS eu-west-2
  • HTTPS on every storefront
  • Custom domain certificates
  • PCI DSS Level 1 card step
  • No card numbers stored

GDPR export and erasure

Orders kept as anonymised records

Handle a data request without a support ticket.

Shoppers get the same kind of sign-in you do, and when one asks for a copy of their data or asks to be erased, each is a button on their record.

Passkeys for shoppers

Switch on “Allow customers to sign in with passkeys” and the sign-in page gets a Sign in with a passkey button, with a Passkeys section in their account.

Two-step for shoppers

Customers can add an authenticator app under Account > Security, or you can require it: anyone without a second step sets one up straight after their next password sign-in.

Export on request

Export customer data (GDPR) builds one file of everything held on that customer in the background and gives you a download link.

Erase, with the checks done first

Erase personal data redacts the profile, addresses, carts and messages and keeps the financial records. It refuses while an order, a return, a subscription or an instalment plan is open, or while an order is inside its 180-day dispute window, and it makes you retype the customer’s email.

See the customer record

Three things to do before your first order.

None of them takes ten minutes.

Day one

Add a passkey, then an app as backup

Settings > Security Settings > Passkeys > Add passkey, named after the device. Then press Add authenticator or SMS and pick the app, so a lost laptop is not a lost account.

  • Passkey
  • Authenticator app
  • Name the device

Same day

Save the ten backup codes

Download the file or copy the codes into a password manager. Each works once, and you can regenerate the set with your password later.

  • 10 codes
  • Download the codes
  • Regenerate with password

First refund

Read the log, then export it

Open Settings > Activity Log after the first refund and the first price change. Filter by action, check it reads the way you expect, and export the CSV for your accountant.

  • Filter by action
  • Export CSV
  • Owner or admin

Sign-in security is not a tier.

Solo

Included from here

£19

a month, billed yearly, ex VAT

Included: Passkeys, two-factor sign-in, backup codes and trusted browsers

14 days free, no card

Team

£64

a month, billed yearly, ex VAT

Included: Passkeys, two-factor sign-in, backup codes and trusted browsers

14 days free, no card

Pro

£187

a month, billed yearly, ex VAT

Included: Passkeys, two-factor sign-in, backup codes and trusted browsers

14 days free, no card

Enterprise

£749

a month, billed yearly, ex VAT

Included: Passkeys, two-factor sign-in, backup codes and trusted browsers

14 days free, no card

Compare every plan

Every plan gets the same sign-in controls and encryption, hosted on AWS in London. For security, what changes by plan is people: Solo has one staff account and it is yours, Team has 10, Pro 40 and Enterprise unlimited. Prices exclude VAT.

One login each

Signing in

Everyone gets their own login: their email and password, then a passkey or a code. So each person’s changes in the activity log carry their own name.

Two years

Sign-in history

Sign-ins, failed sign-ins, password changes and support sessions are logged on the platform side and kept for two years, and your activity log records every change made in the store.

Everywhere at once

Signing out other devices

Change your password and every session ends at once, on every device, and each trusted browser asks for the second factor again.

Read the data processing agreement

Security questions, answered straight.

Second factors, the log, support access, card numbers, customer data and where to report a problem.

Who gets in, and where it runs.

Add a passkey before your first order.

Set up a passkey on day one, save the backup codes, and invite your team with the roles their jobs need. Sign-in security is the same on every plan, from £25 a month.

Start for free14 days free, no cardRead the DPA

We value your privacy

We use cookies to enhance your browsing experience, analyse site traffic, and personalise content. By clicking "Accept all", you consent to our use of cookies. You can manage your preferences or learn more in our Cookie Policy.