Security

1. Scope

This page describes the security of rowedigital.net, the corporate website published by The Trustee for Rowe Digital Trust, ABN 13 313 912 737, and the engineering practices behind it.

We are a small company and we say so plainly here: we do not hold SOC 2 or ISO 27001 certification. What we do instead is keep the attack surface small, hold as little data as we can, and use managed services from providers that are themselves audited.

2. Product security

Accounts, subscriptions and customer data live in the products, not here. How a product encrypts your data, who can reach it, how long it is kept and what happens in an incident is covered by that product's own privacy policy and security information:

• BubSync — privacy policy on bubsync.com
• My Energy Agent — privacy policy on myenergyagent.au

The practices in sections 5 to 7 below are how we build software generally, so they apply to those products too. The specifics of a product's data handling belong to the product.

3. How this website is built

• Static pages. The site is built ahead of time into plain HTML and served from object storage through a content delivery network. There is no application server, no database and no input field, which removes most of the ways a marketing site gets compromised.
• Encryption in transit. TLS 1.2 or higher on every connection, with HTTP Strict Transport Security so browsers refuse to downgrade. Plain HTTP requests are redirected.
• Encryption at rest. The storage bucket behind the site is private and encrypted at rest, and is reachable only through the content delivery network.
• Response headers. Responses carry a Content-Security-Policy that loads resources only from this domain, blocks framing and restricts form submissions to this origin. It also allows inline script and style, which the page needs for the theme switch and the critical CSS; with no user input anywhere on the site, there is nothing for an injected script to arrive through. Alongside it are HTTP Strict Transport Security, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Cross-Origin-Opener-Policy and Permissions-Policy.
• No third-party code. No analytics, no tag manager, no advertising pixels, no embedded widgets. Typefaces are self-hosted. Nothing on the page loads from anyone else's domain.

4. No payments here

No payment is taken on this website. There is no checkout, no card field and no payment provider connected to these pages, so there is nothing here for a card skimmer to attach to. Subscriptions are bought inside a product or through an app store, and that product's policies cover how the payment is handled.

5. Access control

• Access to hosting and DNS is limited to people who need it for their role, and is reviewed when a role changes.
• Multi-factor authentication is required on every administrative account.
• Deployments use short-lived credentials issued through federated identity rather than long-lived access keys, so there is no cloud key sitting in the repository to leak.
• Administrative actions are logged, and logs are retained for review.
• Secrets are held in a managed secrets service, never in source code or configuration files.

6. Secure development

• All changes go through version control and are reviewed before they reach production.
• Automated checks run on every change, and dependency vulnerability alerts are triaged as they arrive.
• Deployments are automated from source control, so what is running is always traceable to a specific commit.
• Infrastructure is defined as code and applied through the same pipeline, rather than clicked together in a console.
• Production data is not copied into development environments.

7. Vendors

We keep the vendor list short and prefer providers with independent security certification. Before a vendor touches personal information we check what it will hold, where it will hold it, and what its own certifications and breach obligations are. The providers behind this website are listed in our website privacy policy.

8. Incident response

We maintain a written incident response plan covering detection, containment, eradication, recovery and review.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Our notification will say what happened, what information was involved, what we have done, and what you should do.

We would rather tell you early and be wrong about the scope than go quiet while we work it out.

9. Responsible disclosure

If you find a vulnerability in this website or in our infrastructure, please tell us before telling anyone else. Email hello@rowedigital.net with "security" in the subject line and include:

1. where the issue is, and what an attacker could do with it;
2. the steps to reproduce it; and
3. how you would like to be credited, if at all.

We will acknowledge within 2 business days, keep you updated while we work on it, and let you know when it is fixed.

For a vulnerability in a product, use the security contact in that product's own policies. It reaches the same engineers and gets to the right codebase faster.

While researching, please:

• use only accounts you own, or test accounts you have created;
• do not access, modify or delete another person's data, and stop as soon as you realise you could;
• do not run denial-of-service tests, automated scanners at volume, or social engineering against our staff or customers; and
• give us reasonable time to fix the issue before publishing anything about it.

We do not run a paid bug bounty. We will not pursue legal action against researchers who follow the above in good faith, and we are happy to credit you publicly if you would like that.

10. What we ask of you

Nothing on this website needs protecting on your side, because there is nothing here to sign in to. Two things are still worth knowing:

• Check who is asking. We will never email you asking for a password, a card number or a one-time code. If a message claiming to be from us asks for any of those, forward it to hello@rowedigital.net instead of replying to it.
• Secure the product account, not the website. Use a unique password, turn on multi-factor authentication where the product offers it, and review who you have shared access with. Each product explains its own controls.