Security

API keys, passwords and sessions

• API keys are stored as SHA-256 hashes. A key is shown once when it is issued; every request is matched by the hash of the key it carries. The privacy policy puts it as API keys as cryptographic hashes; neither can be read back.
• Console passwords are bcrypt hashes (cost 12). The older website admin sign-in hashes with salted PBKDF2-SHA256 and is limited to ten attempts per ten minutes from one address.
• Sessions are hashed at rest. The key console looks a session up by the SHA-256 of its token; the website session cookie is HttpOnly, Secure, SameSite=Lax and stored as its SHA-256. You can end every session on your account from the console, and we email you whenever your password is set or changed.
• Paid keys can be locked to IP addresses. Paid plans can restrict a key to listed IP addresses. The allow-list is a list of CIDR ranges held on the key and checked on every request.
• Account changes are logged and readable. GET /v1/account/events returns your account's own change history: key issues and revocations, plan changes, settings.
• Forms on this site carry a session-bound CSRF token, and anonymous form posts from another origin are refused.

In transit

All traffic to the website and the API is encrypted in transit; plain HTTP is redirected. The web server sets Strict-Transport-Security (HSTS), X-Frame-Options: SAMEORIGIN and X-Content-Type-Options: nosniff on every response.

Payments

Checkout, invoices and the billing portal are hosted by Stripe. We never see or store card numbers; payment details are entered directly with Stripe. What we keep is the Stripe customer and subscription identifiers and the payment status Stripe reports.

Where the data lives

Servers and the database run on DigitalOcean in Sydney, Australia; the privacy policy's sub-processor table records what DigitalOcean receives as Everything in this policy, on infrastructure in Sydney, Australia. Copies of database backups are held with Cloudflare, which May be outside Australia. The full list of providers that receive any of your data, what each receives and where, is the table in section 5 of the privacy policy; this page does not keep a second copy of it.

Backups and recovery

• Nightly. The databases are dumped every night, kept locally on a seven-day rotation, and synced to encrypted off-site storage. Retention, from the privacy policy: Nightly backups are kept for 7 days, weekly backups for 8 weeks and monthly archives for 24 months.
• Restore drill, monthly and automated. On the third of each month a script restores the newest nightly dump of the revenue database into a scratch database, compares row counts on the tables that matter against the live database, logs the result and drops the scratch copy. A backup nobody has restored is a hope, not a backup.
• Point-in-time recovery. A weekly physical base backup of the whole Postgres cluster is streamed, client-side encrypted, to the off-site store, and the write-ahead log is archived to the same encrypted store every two minutes. Together they allow a restore to a point in time; that restore path is a written runbook and has not yet been added to the automated drill, which exercises the nightly dump.

If something goes wrong

From the privacy policy: No system is perfectly secure. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Service state is published on the status page, and the measured state of the data itself on data quality.

Reporting a security problem

Email hamish@punters-edge.com with what you found and how to reproduce it. There is no bounty programme; a report is read by the operator and answered.

Security questionnaires

If your procurement process has its own questionnaire, attach it through the sales enquiry form, which has a security and compliance section for exactly this. It is answered from this page and the privacy policy, so expect the answers above, including the ones that are no. The data licence and pricing pages cover what each plan permits.