Security (draft)

Before publishing

• Create and monitor the security inbox (e.g. security@demostatics.com) before publishing the address.
• Publish a matching /.well-known/security.txt on demostatics.com and docs.demostatics.com.
• Only claim measures that are live in production (check against Security and Privacy and Deployment Readiness).

How we protect your account

• All connections use HTTPS.
• Passwords are stored only as one-way hashes and must be at least 12 characters with mixed case, a number and a symbol.
• Signing in is rate-limited to slow down password-guessing.
• Resetting your password signs out the apps that used the old one.
• App sign-ins expire automatically. TODO: state the period at launch.

How we protect data

• Services run on Amazon Web Services in Frankfurt (EU). TODO: confirm at launch.
• Data is encrypted in transit and at rest. TODO: confirm for the production database.
• Staff access is limited to the people who need it and requires two-factor authentication.

Reporting a vulnerability

If you find a security problem, email TODO: security@demostatics.com with the details and steps to reproduce it. Please do not access other users’ data or disrupt the service while testing, and give us reasonable time to fix the issue before disclosing it. We will acknowledge your report within TODO working days.