> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HOA Features

HOA guarantees security for the following reasons:

* Vindicia receives data submitted by the order form over HTTPS (a secure HTTP connection using Transport Layer Security (TLS)).
* HOA tracks an order-form submission through a `WebSession` object, which is created on the Vindicia server before the order form is presented to your customer. This allows you to preload information, including the IDs of Subscribe objects to which the order refers (such as an existing `BillingPlan` or `Product` object), without displaying the information on the form.
* A `WebSession` object has a 40-character unique ID, which is included as the session ID in the form. This ID expires, 1) after a form is submitted using that ID, 2) after 1 hour (3600 seconds, the default expiration time), or 3) after an expiration time you configure, whichever occurs first. This prevents illegal or repeated use of session IDs by hackers. HOA stores the results of the API call in the Subscribe `WebSession` object. You fetch this object and, based on the results, determine the next steps the customer should take on your site.

Except for iframes, Vindicia does not host any HTML pages in the process. Your customers might notice `Loading https://secure.vindicia.com....`in the status bar of their browser, but only momentarily during iframe load, after submitting the Web order form, and before HOA loads your redirection page. Your order form and success or failure pages, with your branding style, are the only pages visible to your customers.

HOA does not make the API call to create objects containing sensitive payment information, such as an `AutoBill` or a `PaymentMethod` object, until you finalize the `WebSession` object (call `Websession.finalize()`) from the success page that you host. Therefore if the connection is lost while HOA is redirecting the customer's browser from the Vindicia server to your server, your success page will never be reached, the `WebSession` will not finalize, and HOA will not make the API call. This approach preserves data integrity in cases of connections dropped during the processes

For pure Ajax (asynchronous JavaScript and XML) solutions, you will have to call your own success or failure back-end function. See [Using Hosted Fields with Ajax onSubmitCompleteEvent](Using_Hosted_Fields_with#) for details.

**Note:** Vindicia never returns or displays sensitive payment information, such as credit card account numbers, in full. When returning information through an API call, or displaying the data in the Portal, Subscribe always partially masks account numbers.

**Parent topic:**[Hosted Order Automation with Hosted Fields](../topics/ProgGuide_HostedOrder)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.