Security
How we protect your data
Security is part of how we build, not an extra at the end. This page says in plain English what we do to protect the information you share with us and the systems we build for you, what is live on this site, what the client portal does, and how to tell us about a vulnerability.
How we build, on every project
These are the rules we follow for every system we build, including this site. They are commitments about how we work, not a certification: we hold none, and this page will say so if that changes.
- Encrypted in transit and at rest
- Every connection uses HTTPS, with HTTP Strict Transport Security so a browser never falls back to plain HTTP. Backups are encrypted before they leave the server. Disk encryption for this site's own server depends on the hosting provider, which the privacy policy names before launch.
- Least-privilege access
- Each service gets its own credentials, limited to what it needs: this site's application connects to its database with a role that can read and write data but not change the schema. Secrets live in the hosting platform's settings, never in code, logs or commits. Only the two founders can reach production, each with their own account.
- Multi-factor sign-in
- We turn on multi-factor authentication for every founder account on every provider we use. In this site's admin area an authenticator app is required for every team member, and sensitive actions ask for a fresh code.
- Backups and recovery
- We require daily backups for every production database and its files, and we confirm they are running before a system goes live. Before the client portal takes its first client we test a restore, and we keep testing it on a schedule after that, because a backup that has never been restored is a guess.
- Australian data residency where available
- We host in Australian regions where the provider offers one. This site, its database and the files clients upload run on one server we manage ourselves; the privacy policy names its provider and country before launch. Error monitoring, email delivery, analytics, bot checks and the AI services process data overseas, mainly in the United States, and the privacy policy lists each provider and what it receives.
- Secure by default in the code
- Every input is validated on the server, every page carries a Content Security Policy that runs only the scripts we approved, dependencies are audited on every change, and the tests run before anything is deployed. We use the OWASP Top 10 as a checklist and check the client portal against OWASP ASVS level 2 before it launches.
- If something goes wrong
- We keep a written incident plan. If we become aware of a data breach that is likely to cause serious harm, we notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
On this site today
What is live right now, which you can check from your own browser.
- HTTPS only, with strict headers
- Strict Transport Security with preload, a Content Security Policy with a fresh nonce on every request so only scripts we approved can run, nosniff, a strict referrer policy, frame denial and a restrictive Permissions-Policy on every response.
- Forms that resist abuse
- The contact and quote forms use a hidden honeypot field, a signed timing token that works only once, rate limits per connection and per email address, Cloudflare Turnstile, then an automated risk score that includes an AI classification. A submission the checks flag is kept and held for a founder to review, never deleted because of its score.
- Limits on AI and the assistant
- The project wizard and the assistant run behind per-visitor limits and daily caps on AI use and voice minutes, so nobody can run up costs or crowd out other visitors. User text is passed to the AI as data, never as instructions, and prices come from our published ranges, never from the model.
- Analytics that wait for you
- Analytics scripts load only after you interact with a page or it has sat idle, and we honour the Global Privacy Control signal. Error monitoring is configured not to collect IP addresses, cookies, headers or form contents.
- Logs that record events, not content
- Fields that hold names, email addresses, messages and IP addresses are redacted before anything is written to a log, and email addresses are removed from error text.
- A published contact for researchers
- The security.txt file at /.well-known/security.txt gives the standard machine-readable contact and points back to this page.
In the client portal
The controls built into the client portal, where clients follow their projects, share files and accept quotes. They are tested on every change, including tests that try to reach another organisation's records.
- Sign-in
- Passwords of 12 characters or more, checked against known breaches and stored only as an Argon2id hash; emailed sign-in links, passkeys and Google sign-in once we switch it on; and an optional authenticator app. Repeated failures are slowed down, and sign-in answers never reveal whether an address has an account.
- Sessions
- Sessions live in secure, HTTP-only cookies that are never sent to other sites, are issued fresh at every sign-in, end 24 hours after your last action and seven days after sign-in at most. You can see and end your sessions, and sensitive actions ask you to confirm your identity again.
- Security emails
- You get an email when a new device signs in, when your password, passkey or authenticator changes, and when your account is suspended. Emailed sign-in links open a page that asks before signing anyone in, so a link opened in another browser cannot sign you into someone else's account.
- Each organisation sees only its own records
- Every record belongs to an organisation, and the server checks on every request that the signed-in person is a member of it; another organisation's project, file or quote answers as if it did not exist. Record IDs are random and not guessable, and automated tests try to cross organisations for every data function.
- Files checked and scanned
- Uploads are limited to PDF, Word, PNG and JPEG files of 10 MB, checked by their content rather than their name, refused if they carry scripts, macros or embedded objects, and scanned for malware. Nothing can be downloaded until the scan is clean, and an infected file is never shared.
- Signed, short-lived downloads
- Files sit in private storage under random names. Each download uses a signed link that expires after 15 minutes and works only for the person it was made for. Images in project updates are shown inline inside a sandboxing policy that stops anything in them from running; every other file downloads as an attachment.
- An activity record
- Sign-ins, uploads, quote decisions and every change our team makes are written to an activity log that cannot be edited; entries are deleted only by the retention job, after 24 months. A quote acceptance records the typed name, the time, the IP address and a fingerprint of the quote as it was shown.
- Your data, your call
- Export your data as a download, or ask for your account to be deleted, from the portal's settings. A founder checks what must be kept for legal reasons before anything is deleted, and tells you.
Report a vulnerability
If you find a security problem in this site, in the client portal or in something we built, email contact@eloradigital.com.au with “Security” in the subject line. The address reaches both founders directly. Please do not post details publicly until we have fixed the problem.
We acknowledge reports within 2 business days (Melbourne time) and give an initial assessment within 5 business days. We will keep you informed while we fix it, tell you when the fix is live, and credit you if you would like that. Good-faith research that stays within the scope in our security policy is welcome and will not be pursued.
What to include
- The URL, route or feature affected.
- Steps to reproduce, with a proof of concept where you can: requests, payloads, screenshots or a short recording.
- The impact as you understand it: what data or action an attacker could reach.
- A way to reach you, and a name or handle if you would like to be credited.
Our security.txt file has the same contact in the standard machine-readable format.
Tell us about your project
Describe it in your own words and get a reply with an estimate range within one business day.