Security
Security controls built into the portal.
ORACLE CAPITAL uses guarded routes, session isolation, request limits, file validation, and account-state checks across the platform.
Signed sessions
Session state is stored in an HTTP-only cookie signed with HMAC SHA-256 and an eight-hour expiry.
Protected APIs
Dashboard and KYC APIs check authentication server-side before returning account data or updating status.
Rate limits
Login, dashboard, contact, and upload endpoints apply bounded request windows to reduce abuse.
Validated input
Forms use strict schema validation and return safe user-facing messages without raw errors.