Security, privacy, and transparency requirements for every application using “Sign in with Orneos”.
1. Data Protection & Transparency (GDPR)
Your application must publish a clear HTTPS privacy policy before submitting for verification.
Request only the scopes strictly needed by your service and never sell or transfer Orneos identity data to data brokers.
When a user revokes your application or deletes their account, you must delete their tokens and cease access immediately.
2. Credential Security & Prohibited Uses
Never embed a client_secret in client-side code (browsers, mobile apps, public Git repositories). Use the “Public client” type for SPAs and native apps.
Impersonating Orneos sign-in screens (phishing) or asking for a user’s Orneos password outside login.orneos.eu is strictly forbidden.
Orneos may suspend without notice any application that poses a security risk, exhibits abnormal error rates, or attempts to bypass platform limits.