How we protect information
In transit and at rest
- Every connection uses HTTPS, and the browser is told to insist on it.
- The database is encrypted at rest by its host.
- Health notes and uploaded documents are encrypted again, with a key that is held in the host’s environment and never in the database or the code. A stolen copy of the database or a backup does not contain anybody’s medical notes in readable form.
The service is not end-to-end encrypted, because the organisation’s own software must read members’ information to run the roll, send messages and take payments. Protection comes from encryption where it counts, strict access rules and keeping little.
Getting in
- There are no passwords to steal or reuse. You sign in with a single-use link emailed to you, which expires after fifteen minutes.
- Links and sessions are stored only as one-way hashes, so a leaked database does not let anyone sign in.
- Sign-in attempts are limited per address and per place, and every attempt is recorded.
- Forms are protected against being sent by another website.
Who may see what
- Every request is checked against the person’s role at that organisation, and the check runs in the database.
- Every screen is tested as a stranger would see it, and the tests fail if a screen is open to someone who should not see it.
- Changes to records are recorded with who made them.
- Messages about a child go to their parents or guardians.
- Owners and administrators, who can see every member’s details, sign in with a code from an app on their phone as well as the emailed link.
How the software is built
- The application uses no third-party code libraries, which removes a common way for attackers to get in.
- The source is scanned on every change for the usual mistakes, such as unsafe database queries, unescaped text on a page and secrets left in code.
- The content security policy stops other sites’ scripts from running on a page.
What is still to do
No system is perfectly safe, and we would rather say what we have not yet done.
- An independent security test of the live service.
- Automatic alerts when something breaks or looks wrong.
- A regular, tested restore from backup.
If you find a weakness, please tell us at richardbenson@outlook.co.nz before you tell anyone else. We will thank you and fix it, and we will not take action against anyone who reports in good faith.