O Ordic
Sign in Get started
Security

Three security promises Ordic makes by construction.

Not "by policy" — by code. Each promise is wired into the platform's architecture, not a checkbox in a settings panel.

01

The agent only runs validated wrapper scripts via sudoers — never raw shell.

There is no os.system() path in the agent. Each op is a named wrapper script with typed args, allow-listed in sudoers, audited on every call.

proof: /etc/sudoers.d/ordic-agent ↓
02

Plans capture intent, proposed steps, approval, execution, and result.

Every action lands in audit. Plan rows show the trust loop end-to-end — you can see the LLM proposed, the operator approved, the agent executed, the row landed. No black box.

proof: trust-loop receipt below
03

You bring your own server. Ordic never holds root credentials.

The agent enrolls itself with a one-time token, then heartbeats back. You can revoke its access at any time by killing the systemd unit. Your data plane stays on your machine.

proof: systemctl stop ordic-agent · done
# /etc/sudoers.d/ordic-agent — generated, immutable, audited
ordic-agent ALL=(root) NOPASSWD: /usr/local/lib/ordic/wrap/svc-restart [a-z0-9_-]+
ordic-agent ALL=(root) NOPASSWD: /usr/local/lib/ordic/wrap/pkg-update [a-z0-9.+-]+
ordic-agent ALL=(root) NOPASSWD: /usr/local/lib/ordic/wrap/sshkey-write [a-z0-9_-]+
# 38 wrapper scripts total. Add a new one? PR + review + signed release.
How it differs

Smaller surface, smaller attack surface.

What competitors brag about, we count as risk. Thousands of CGI handlers. Plugin sprawl with 0-day cadence. Ordic ships a small enumerated catalogue of narrow ops with explicit permission scopes. The constraint is the feature.

cPanel incumbent
~3,000+
cgi handlers
Plugin-CGI architecture. Every WHM plugin adds a new endpoint. Surface grows monotonically with every release.
WordPress incumbent
~60,000
plugins · 0-day cadence
Every install is a unique mix. Every plugin is a vendor-trust decision. The maintenance burden lands on the operator.
Ordic v1
38
narrow ops · enumerated
A small catalog of typed ops. Adding one means a PR, a review, a signed release. The list is the contract.
What we audit

Every action lands in audit. Sensitive params redacted to fingerprints.

These use the same audit format the operator console writes today — same field semantics, same redaction rules. SSH keys never appear as raw bytes; they're stored as SHA256 fingerprints. Failures and errors get their own colour and stay visible alongside the successes.

✓
2026-05-04 14:32:01 UTC
add_ssh_key  who=adam · resource=web-1-syd · key_fingerprint=SHA256:abc123…7Vq2
result=ok
✕
2026-05-04 14:33:12 UTC
backup_run  who=@auto · resource=blog-acme · plan_id=plan_3f9c · err=destination_unreachable
result=fail
!
2026-05-04 14:33:18 UTC
publish_release  who=maya · resource=blog-acme · commit=3604125 · err=build_timeout
result=error
The trust loop · plan group
Restart nginx after config change
plan_3f9c · 4 steps · 1.2k tok · haiku-4.5
proposed
1
@llm svc_restart(name=nginx) after editing /etc/nginx/sites-enabled/blog
14:32:01
approved
2
@adam approved · with comment "checked diff, looks fine"
14:32:18
executed
3
@agent ran /usr/local/lib/ordic/wrap/svc-restart nginx · exit 0 · 0.4s
14:32:19
audited
4
@platform wrote audit_event(plan_id=plan_3f9c, result=ok) · row sealed
14:32:19
What we don't do

Some things on purpose, some things not yet.

We don't run your server
No managed hosting offering. The agent runs on your box; root stays with you. Kill the systemd unit, you're disconnected.
We don't manage your DNS yet
DNS onboarding is on the roadmap, not shipped. v1 expects your records to point at the right server before you connect.
We don't store your customer data
CMS content lives in your git repo. The operator console DB only stores org metadata, audit, and operator accounts.
We don't claim SOC 2
Pre-pilot. No certifications yet. The architecture is the argument right now; certifications come after the architecture stabilises.
Found something? Tell us privately.
Send a write-up to security@TBD, encrypted with our age key age1… fingerprint TBD. Real reply from a real engineer within a week. No bug bounty yet — pre-pilot, that's a deliberate choice, not an oversight.
Open contact form →