rotorloop
Docs contents

Docs / Reference

Security overview

How Rotorloop handles network access, credentials, roles and records.

Network

  • The Connector makes one outbound, encrypted connection (TLS on port 443). No inbound ports are opened at the site, and controllers are never exposed to the internet.
  • Each Connector has its own token. Admins can revoke a connector, which disconnects it at once.

Credentials

  • Access keys and connector tokens are shown once, when they're created. Rotorloop stores only a one-way hash (SHA-256) of each, so we can't recover or show them later.
  • Live updates in the app use short-lived, single-use tickets.
  • Single sign-on (Google, Microsoft) and two-factor sign-in are planned.

Access control

  • Roles (viewer, operator, admin, owner) are checked by the server on every request.
  • Safety rules are enforced again at the site, by the Connector, so a request that got past the app still can't exceed a point's settings.
  • Every change and every admin action is recorded in an activity log that can't be edited from the app or the API.

Hosting and data

  • Rotorloop runs on Cloudflare's network. Configuration, people and the activity log are stored in Cloudflare D1.
  • Rotorloop stores point names, values, settings and activity. It doesn't store controller programs or passwords for your control systems.
  • The app and site send strict browser security headers, including a content security policy. There are no analytics or advertising trackers.

Reporting a problem

If you think you've found a security issue, please tell us through the early-access form and start the notes with "Security". Please don't test against sites you don't own.

Applies to Rotorloop 0.2 (development preview). Last reviewed November 2026.