This page covers two separate things: how this website is secured, and how we work on client systems. Prospective clients usually want the second.
Reporting a vulnerability
If you have found a security issue in this site or in anything we operate, write to support@altuslabshq.com. Include enough detail to reproduce it.
We will acknowledge within two business days, tell you our assessment within five, and let you know when it is fixed. We do not run a paid bounty programme, and we will not take legal action against anyone who reports a genuine issue in good faith without accessing data that is not theirs.
This website
The site is statically generated and served from a content delivery network. Almost every route is a pre-rendered HTML file with no server side execution, which removes most of the attack surface a conventional web application has.
The single exception is the contact form, which posts to a server action protected by:
- A hidden honeypot field that legitimate users never see
- An HMAC signed token issued when the form is rendered, rejecting direct posts and implausibly fast submissions
- Per address rate limiting
- Schema validation on every field before anything downstream is touched
- HTML escaping of all user supplied text before it is rendered into an email
There is no database attached to this site, no user accounts and no session cookies. The only personal data on our infrastructure is what you choose to send us, and it lives in email.
Transport is TLS 1.3 with HTTP Strict Transport Security. Secrets live in the deployment platform's encrypted environment store and are never present in the client bundle.
How we work on client systems
Access. We work under least privilege. We ask for the narrowest access that lets us do the job, we use your identity provider rather than shared credentials, and we expect access to be revoked when an engagement ends. If a client offers us broader access than we need, we decline it.
Credentials. No shared logins, no credentials in chat, no secrets in source control. We use a password manager with enforced multi-factor authentication and hardware keys for anything privileged.
Devices. Company managed laptops with full disk encryption, automatic screen lock, current operating system patches and endpoint protection. Client code does not go on personal machines.
Source control. Signed commits, protected branches, mandatory review, and automated dependency and secret scanning on every pull request.
Production data. We do not copy production data to development environments. Where realistic data is needed for testing we generate it or use an anonymised extract produced by a documented process.
Incidents. If we become aware of an incident affecting a client system, we notify the client immediately and in writing, and we support their disclosure obligations rather than making judgements about them on their behalf.
Compliance posture
We align our internal controls to SOC 2 Trust Services Criteria and to ISO 27001 practice. We are candid about status: we operate to these standards and we are not currently certified against them. If a certified supplier is a requirement for your procurement process, tell us early and we will say plainly whether we can meet it.
For engagements in regulated sectors we work under the relevant framework: HIPAA business associate agreements for United States healthcare, GDPR data processing agreements with standard contractual clauses for European work, and PCI DSS scope reduction for payments work.
Agreements we sign
- Mutual non-disclosure agreements, before you share anything sensitive
- Data processing agreements with standard contractual clauses
- Business associate agreements where protected health information is involved
- Your security addendum, subject to review
Send yours or ask for ours. We usually turn these around within a business day.