Our approach
We build security in from the start, with encrypted connections, role-based access, regular backups and monitoring. We’re happy to talk your team through it and answer compliance questions.
We set up encryption, backups and access control at the start of a project, so they are part of the design rather than added later.
This website
- Pages are served only over encrypted HTTPS connections, through Cloudflare’s network, which also protects the site from attacks.
- The site runs no analytics or advertising tools. The only third-party script is Cloudflare Turnstile, the spam check on the contact page.
- The contact form checks every message on our server: a spam check, a hidden trap field, a minimum time to fill it in, and a limit on how many messages one visitor can send. Visitors’ IP addresses are stored only as a one-way coded value.
- The contact page can’t be shown inside another website’s frame.
- Passwords for our content system are stored only as salted scrypt hashes, never in plain text.
- Signed-in sessions use a signed, httpOnly cookie that expires after 8 hours. Resetting a password or disabling an account signs that account out everywhere.
- Each person has a role (admin, editor or viewer) that limits what they can see and change, and every change is logged.
The platforms we run
The software we build and run for clients follows the same approach: encrypted connections, roles that limit what each person can see, regular backups and monitoring. Each platform’s documentation describes its own measures; for example, the Travnet Search Engine stores passport numbers encrypted and keeps an audit trail.
We don’t claim certifications we don’t hold. If you need details for a security review, ask us.
Reporting a vulnerability
If you think you’ve found a security vulnerability in sitenet.tech or in a platform we run, please tell us. We welcome reports from everyone, and we’ll work with you to understand and fix the problem.
How to report. Use our contact form and choose “Security issue”. Please include the address or system affected, what you found, the steps to reproduce it, and what an attacker could do with it.
In scope: sitenet.tech and the platforms Sitenet builds and runs, including the Travnet Search Engine and its developer console.
Out of scope: services run by other companies, such as Cloudflare, Amazon Web Services and Google (please report those to them); denial-of-service attacks; spam; social engineering or phishing of our staff or clients; physical attacks; and reports from automated scanners without evidence that the issue can be exploited.
Rules for testing
When you look for vulnerabilities, please:
- access, change or delete only as much data as you need to show the problem, and never other people’s data beyond that;
- stop and report as soon as you find a problem, rather than exploring further;
- not degrade the service for others, for example with heavy automated traffic;
- not use what you find for anything other than reporting it to us; and
- keep the details private until we’ve fixed the problem, or agreed with you when to publish.
What we’ll do
- Confirm that we’ve received your report.
- Keep you updated while we investigate and fix the problem.
- Tell you when it’s fixed, and agree with you when the details can be published.
- Thank you publicly for the report, if you’d like us to.
If you report in good faith and follow this policy, we won’t take legal action against you for your research, and we’ll treat it as authorised. If someone else takes action against you about it, we’ll make clear that your research followed this policy.
