Approach
We state only controls that are in place and can be checked. We aren't certified against any security framework and won't claim otherwise.
This website
- HTTPS only, with HTTP Strict Transport Security (HSTS)
- A strict Content Security Policy that allows scripts only from this site and two named code CDNs, blocks form posts to other sites, and blocks the site from being framed by other domains
- No cookies, no analytics, no third-party trackers
- The normalizer runs in your browser, so the files you drop never leave your device
The settleD app (pilot)
- Works offline. The workspace stays in your browser's storage, and there's no server copy to breach.
- No analytics and no outbound network calls with your data
- Released statements are frozen, and any change to their inputs withdraws approval
- Invite-only access. There's no open registration.
Your device's own security matters most today. Use a device passcode, disk encryption and an up-to-date browser, and keep backups.
Account sync (not yet live)
Commitments for sync are listed in the Data Policy. Before sync launches, this page will be updated with the controls that are actually in place.
Report a vulnerability
Email wolf@ward.bz with the subject "Security". Include steps to reproduce the issue. We'll acknowledge your report within 3 business days and keep you updated. Please make a good-faith effort to avoid privacy violations and service disruption, don't access data that isn't yours, and give us reasonable time to fix the issue before you disclose it. We won't pursue legal action against good-faith research that follows these rules. Machine-readable contact details are at /.well-known/security.txt.
Questionnaires
If your agency needs a security questionnaire answered, ask. You'll get direct answers instead of a badge.