Orka
EN
Request a demoDemo

Security and network requirements

A fact sheet for your company's IT team: which domains to allow, what traffic Orka generates, and how access and data are protected.

Last updated:

On this page

Domains to allow

Orka uses three domains of its own, Google sign-in, and OpenStreetMap tiles for the geographic map:

  • orkafield.com — public website and documentation.
  • www.orkafield.com — the same website.
  • app.orkafield.com — the platform (web console).
  • accounts.google.com — sign-in with a Google account.
  • tile.openstreetmap.org — base map for the geographic map in the Field view.

Network

  • HTTPS only, on port 443, over HTTP/2 and HTTP/3.
  • Browsers connect with TLS 1.2 or 1.3; TLS terminates at Cloudflare.
  • No WebSockets, no extra ports, no agents, no browser extensions, and no executable downloads.
  • Exports are data and report files (for example XLSX, CSV, PDF, or PNG) generated on app.orkafield.com.
  • Data uploads are your company's own spreadsheet files.

Authentication and sessions

  • Sign-in with each user's Google account (Google OAuth 2.0): Orka receives the account's name and email address from Google.
  • 5-minute access tokens; sessions end after 8 hours of inactivity and last 12 hours at most.
  • Roles and permissions per company; isolation between companies is enforced in the database (row-level security).

Data and location

  • Data belongs to the customer and is used only to provide the service.
  • Our own infrastructure behind Cloudflare (CDN, TLS, and DDoS protection).
  • Data hosted in Chile, with a replica in Colombia.
  • Daily backups, encrypted and stored off-site.
  • Technical access logs for operations and security.
  • Only Cloudflare, Google (sign-in), and OpenStreetMap (map tiles) see the traffic.
  • No trackers, no third-party analytics, and no advertising.

About the domain

orkafield.com was registered on 2026-08-31 with Cloudflare Registrar. Until early October 2026 it may be classified as a “Newly Registered Domain” by filters such as Netskope, Palo Alto, or Zscaler; that category reflects the domain's age. The domain will not change.

If your filter blocks it, allowing the domains above is enough.

Responsible disclosure

If you find a vulnerability, write to [email protected]. Our security contact is also published at /.well-known/security.txt.

Support

For questions about using or accessing the platform, write to [email protected].