How we protect this site, our products and the people who use them.

This website

The best defence is to give an attacker nothing to attack. This site is designed around that idea.

• No moving parts. It is a static site: no server-side code, no database, no accounts, no logins, no forms and no JavaScript. There is nothing to inject into and no session to steal.
• No third-party code. Every file, including the fonts, is served from zelvoristech.com. Nothing is loaded from another company's servers, so a compromise of someone else's code cannot reach you through this site.
• Encrypted only. The site is served over HTTPS with HTTP Strict Transport Security, so browsers refuse to load it insecurely.
• A strict Content Security Policy tells browsers to refuse scripts, frames, forms and any resource not from this domain, backed by the standard browser hardening headers.
• A shield in front. Traffic passes through Cloudflare's network, which filters attacks and malicious traffic before they reach the site.
• Checked before release. Every change is security-checked before it goes live.

Our products

Our apps handle personal data, so they are held to a stricter standard than this website. Every app must meet the following before it reaches the public.

• Data isolation. Each person, or the family they invite, can see only their own data.
• No secrets in code. Keys and passwords live in protected environment settings, never in a file or a repository.
• Independent, attack-minded testing of every feature. Someone other than the person who built it tries to break, abuse or leak each feature before it counts as done.
• Security-checked before every release. Nothing ships with a known serious weakness left unfixed.
• Independent security review before launch, and professional penetration testing as products mature.
• Data minimisation. We collect only what a feature needs, and each app has its own privacy policy.
• Small launches first. Every app goes to a small group of real users before it is announced publicly.

Report a vulnerability

If you believe you have found a security issue in this website or in a Zelvoris product, please tell us before you tell anyone else.

Our machine-readable contact details are published at /.well-known/security.txt, following RFC 9116.

We do not run a paid bug bounty at this stage. We will credit you, with your permission, once the issue is fixed.

Scope and safe harbour

This policy covers zelvoristech.com and, once they launch, the Zelvoris apps and their websites. Research carried out in good faith and in line with this policy is welcome. If you follow it, we will treat your research as authorised by us, we will not take legal action against you, and we will not report you to the police. If anyone else complains about research that followed this policy, we will make it known that we authorised it.

To stay within this policy:

• avoid harming people, degrading the service, or changing or destroying data;
• access only the minimum data needed to show the issue, stop as soon as you reach personal data, and do not keep, share or publish it;
• do not use denial-of-service, physical, social-engineering or spam techniques, or automated scanning that sends heavy traffic;
• give us 90 days to fix the issue before disclosing it publicly, or a shorter time if we agree it with you.

We can only authorise testing of systems we control. Services run by others, such as our hosting, network or email providers, are outside this policy; testing them needs their permission, and issues in them should be reported to the provider concerned. Nothing here permits anything that breaks the law where you are. If you are unsure whether something is in scope, ask us first.