Security built in, not bolted on
Orbit Domains (“Orbit”, “we”, “us”) is a domain registrar reseller: we help you search for, register, transfer, renew, and manage domains, with registrations fulfilled through our ICANN-accredited registrar partner. Because a domain controls your email, website, and brand, we treat its security as critical infrastructure.
We combine encryption, strong account controls, registry-level domain protections, secure payments, and continuous attention to abuse and vulnerabilities. The sections below describe each layer and what it means for you.
Encryption & SSL
Every connection to orbitdomains.net is served over HTTPS, so the data you exchange with us — searches, account details, and checkout — is encrypted in transit using modern TLS. This prevents eavesdropping and tampering between your browser and our servers.
Free SSL/TLS certificates are included on every domain that supports them, so the sites you build on your Orbit domains can be served securely from day one, without an extra purchase.
Account protection
Authentication is handled by a dedicated, well-maintained auth layer. Passwords are never stored in plain text — they are kept only as a salted, one-way hash, so even we cannot read them. Sessions are issued as signed tokens and can be revoked.
- Two-factor authentication adds a second step at sign-in so a leaked password alone cannot open your account — enable it as soon as you create your account.
- Bot and abuse protection (Google reCAPTCHA v3) scores sign-in, sign-up, and sensitive lookups in the background to block automated attacks without getting in your way.
- Sensitive account changes are protected, and we send security notices for important events so you can spot anything unexpected.
- Keep your recovery email current and unique to your account — it is how we reach you about security and how account recovery works.
Domain-level safeguards
Some of the most important protections live at the registry, not just on our site. Orbit surfaces and manages these for you:
- Registrar lock keeps a domain from being transferred away without your explicit authorization.
- Transfers require an authorization (EPP) code and respect registry lock periods, reducing the risk of unauthorized moves.
- Auto-renewal and proactive expiry reminders help prevent the single most common way people lose a domain — letting it lapse by accident.
- WHOIS privacy is included on every eligible domain, masking your personal contact details in public records (see Data privacy below).
- Live provisioning is guarded by an internal safety kill-switch, so registration actions only run under controlled, verified conditions.
Secure payments & PCI
Payments are processed by our PCI-DSS-compliant payment provider (Stripe). Your full card number is sent directly to the processor and is never stored on Orbit’s servers — we only receive a confirmation and limited details such as the card brand and last four digits.
Checkout runs over encrypted connections, and the amount you see is the amount you are charged, with no hidden handling of your card data on our side.
Infrastructure & provider security
Orbit never exposes registrar credentials to your browser or mobile app. All calls to our registrar partner’s API are made server-side from an IP-whitelisted environment, so the keys that can register, transfer, or modify domains stay on trusted infrastructure only.
We rely on established, security-focused providers for fulfilment, payments, bot protection, and currency data, each under terms that constrain how they may use information we share. We monitor our systems and work to keep dependencies patched and current.
Data privacy & compliance
We collect only the information needed to provide the service and to meet ICANN and registry requirements, and we explain exactly how it is used in our Privacy Policy. We do not sell your personal information.
Under ICANN’s Registration Data Policy, personal contact data in public registration records is redacted by default, and with WHOIS privacy enabled your details are further masked behind a privacy service. We work to meet the demands of privacy laws such as the GDPR for our customers and ourselves.
Abuse prevention
A trusted domain space depends on acting quickly against misuse. We review reports of malware, phishing, pharming, spam, and inaccurate registration data, and we take action under our Terms of Service and Acceptable Use Policy where warranted.
If you have encountered a domain registered through Orbit being used for abuse, please tell us using our Report abuse page so our team can investigate.
Report a vulnerability
We welcome reports from the security community. If you believe you have found a vulnerability in Orbit, please practice responsible disclosure: email the details to [email protected] and give us a reasonable opportunity to investigate and fix the issue before any public disclosure.
A helpful report includes clear reproduction steps, the affected URL or endpoint, and the potential impact. Please do not access or modify other users’ data, degrade our service, or run intrusive automated scans. We will not pursue good-faith research that follows these guidelines, and we appreciate your help keeping Orbit safe.
Your part in staying secure
Security is a partnership. A few habits make a real difference to how well your domains are protected:
- Use a strong, unique password for Orbit and store it in a password manager.
- Turn on two-factor authentication, and keep your recovery email accurate and secure.
- Keep your registrant contact details current so important registry and verification emails reach you.
- Be wary of phishing: Orbit will never ask for your password by email, and we will never ask you to pay through unofficial channels. When in doubt, navigate to orbitdomains.net directly rather than following a link.
Contact
For security issues, email [email protected]. For abuse reports, see our Report abuse page. For questions about how we handle your data, email [email protected].