Security

Reporting a security problem

If you believe you have found a security problem in Supriva, write to security@supriva.com.au. A person reads that address, and you will hear back from one.

Tell us what you found, where, and how to see it for ourselves: the address of the page or the request, the steps you took, and what happened. A screenshot or a short recording helps. A working example helps most.

If you would rather not put the details in an email, say so in a first message and we will arrange another way to receive them.

We do not pay for reports. We do read every one.

What you can expect from us

We will acknowledge your report within three business days. Within ten business days we will tell you what we have found and what we intend to do about it. If the fix takes longer than that, we will tell you how it is going, and we will tell you when it is done.

We will not take legal action against you for research that follows the rules below, and we will not ask you to sign anything to have your report heard.

If you would like to be thanked publicly once the problem is fixed, tell us and we will. If you say nothing, we will not name you.

We ask that you do not publish what you found until we have fixed it or 90 days have passed since your report, whichever comes first, and that you talk to us about what you intend to publish before you do.

What we ask of you

Test only against accounts that are yours, or that you have been given permission to use. If you come across information about another person, stop, delete any copy you have made, and tell us what you saw.

Show that a weakness exists and go no further. Reading, changing or deleting information that is not yours is not research, however you reached it.

Do not send large volumes of requests at the live service. Members are booking and meeting on it while you test.

What is in scope, and what is not

In scope: supriva.com.au and everything served under it, including the interfaces the Supriva apps use, and community.supriva.com.au.

Out of scope:

• Denial of service of any kind, and anything else that degrades the service for the people using it.
• Social engineering of our staff or our members: phishing, pretexting, or any other attempt to talk a person into giving something up.
• Physical attacks on people, premises or devices.
• The services we build on. Stripe, Amazon Web Services, Google, Apple and Microsoft each run their own disclosure programmes, and a problem in one of them belongs there. A problem in how Supriva uses them is ours, and we want to hear it.
• The public registers of the registering bodies, which are theirs.
• Reports from automated scanners with no demonstrated impact, and observations about best practice with no path to harm.

Anything not listed as in scope is out of scope. If you are unsure, ask first.

Where your information lives

Supriva runs on Amazon Web Services in the Sydney region, and the information members give us is stored there, in Australia. Our privacy policy names the few providers that hold some information overseas, and says what each of them holds.

The servers that run the application have no public address and cannot be reached from the internet except through our load balancer. The database has no route to the internet at all, in either direction, and accepts connections only from the application.

Backups are taken automatically, kept for 14 days in the same region, and let us restore the database to a point in time within that window.

Encryption

Every connection between your browser and Supriva is encrypted, over HTTPS using TLS 1.2 or later, and browsers are told to accept nothing less from us. The connection between the application and its database is encrypted too, and both ends require it.

What we store is encrypted at rest: the database and its backups, the files members upload, and the secrets the application runs with.

Credentials a supervisor gives us for a calendar or a practice management system are encrypted with a key that is kept apart from the database, so a copy of the database alone cannot read them.

Your account

We never store your password. What we keep is a scrambled form that cannot be turned back into the original, so there is nothing for anyone to read, including us. Nobody at Supriva can look up your password or tell you what it is; if you have forgotten it, we can only help you set a new one.

After five wrong attempts, sign-in on the account pauses for 15 minutes. A password reset link lasts 30 minutes and works once, and setting a new password signs the account out everywhere else.

You can sign in with Google or Apple instead, and then there is no Supriva password to lose. Signing in that way is a visit to Google or Apple and back; we never see the password you use there.

The cookie that keeps you signed in cannot be read by scripts in the page, is sent only over an encrypted connection, and ends when you close your browser unless you asked to stay signed in, in which case it lasts 90 days. Signing out ends the session on our side, not only in your browser.

You can add a passkey to your account. The actions that matter most, such as signing a supervision agreement, ask for it at the moment they happen.

Nobody at Supriva will ever ask you for your password, by email, by phone or in person. Any message that does is not from us, and we would like to see it: forward it to security@supriva.com.au.

Who can reach our systems

Nobody at Supriva holds a standing key to production. Access is through single sign-on with a passkey, lasts a few hours at a time, and is read-only unless administrative access is chosen deliberately for that sign-in.

There are no servers to log into. The application runs in containers that are built from the repository and replaced whole on each release.

Every administrative action in our cloud accounts is recorded in an audit trail the accounts themselves cannot alter, and kept for years.

The credentials the application needs are held in a secrets store and given to it when it starts. They are not written into the code or the repository.

Within Supriva, access to member information is limited to the people who need it for their work, and what they look at is logged. Staff accounts are separate from member accounts and can belong only to a Supriva address.

How we build the application

Every change to the application goes through a pull request and an automated test suite before it can be merged, and reaches production only as a new container image built from what was merged.

Some habits are built into the application rather than remembered at each change. Every value rendered into a page is escaped unless a template says otherwise. Every database query passes its values as parameters, never by building a statement out of them. Every form carries a token against cross-site request forgery. Every response carries a Content Security Policy that allows no inline script and runs no third-party scripts or analytics, along with the headers browsers use to refuse framing and content sniffing.

Our server logs remove the things that should never be written down before a line is written, such as one-time links and the email addresses that appear in web addresses. Logs are kept for 90 days.

The services we build on

Payment card details go to Stripe and never pass through Supriva. What we hold is a reference to your Stripe record. If you are a supervisor, Stripe also holds your payout details.

Video sessions run inside Supriva on infrastructure in the same Sydney region. We record who joined a session and when, so that it counts, and nothing else. We do not record audio or video.

If something goes wrong

We have a written data breach response plan, and it starts the moment we suspect that personal information may have been accessed, disclosed or lost without authority. If a breach is likely to cause you serious harm, we will tell you, and we will tell the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Our privacy policy says more about what we hold and how long we keep it.

Changes to this page

When we change this page we update the date at the top. We keep every earlier version, and you can ask us for the one that applied on any given day.

A machine-readable form of this page, for the tools researchers use, is at /.well-known/security.txt.

Contact

Security problems go to security@supriva.com.au. Questions about your account go to support@supriva.com.au, and questions about your information to the Privacy Officer at privacy@supriva.com.au.

The terms for the public parts of this site are the website terms of use, and our privacy policy says what we collect and why.