How we protect this site and your details

1. Your connection

Every page and form uses HTTPS, so what you send can’t be read or changed on the way. Plain HTTP requests are redirected to HTTPS, and browsers are told to use a secure connection for the next year. Our certificate comes from Let’s Encrypt and renews by itself.

2. The website

Most break-ins go through a login, a database, a plugin or someone else’s script. This site has none of them:

• Pages are plain files built ahead of time. There is no content system, no database and no admin login on the site.
• Pages can only be read. The forms are the only things that accept data.
• Strict browser rules allow scripts, styles, images and fonts only from billionesia.com, block other sites from framing our pages, and stop scripts from writing raw HTML into a page.
• We don’t send information about your visit to other companies. Links to other sites don’t tell them which of our pages you came from.

3. The forms

• Encrypted as it arrives. Each message is locked with a public key the moment it reaches the server. The private key that opens it isn’t on the server, so someone who got into the server still couldn’t read saved messages. If encryption ever fails, the message is refused rather than stored in plain text.
• No IP addresses kept with messages. To stop abuse, an address is scrambled and held in memory for one hour, then forgotten.
• Limits on abuse. Requests from other websites’ pages are refused. Size limits, a limit per connection and an overall limit per hour keep out bulk spam.
• Nothing goes to logs. The form service doesn’t write what you send to any log.
• Deleted on schedule. Enquiries delete themselves after 24 months, and privacy requests and security reports after 36 months, unless we need them for an ongoing matter or the law requires longer.

4. The server

• The site runs in its own locked-down container. It has no network access, opens no ports, can’t change its own files, has no special permissions and has strict memory and CPU limits.
• A firewall leaves only the necessary ports open. Administrator access uses keys only, with passwords turned off and repeated failed attempts blocked.
• The server installs security updates automatically.
• The folder that holds saved messages can be opened only by the form service and the server’s administrator, and its contents are encrypted.

Our server is hosted by DigitalOcean in Bangalore, India. Our privacy policy explains what that means for your data.

5. How changes go live

Every change is built from version-controlled source code and tested before release. The new version starts next to the old one and must pass its checks before anyone sees it. If the public site then fails a check, it switches back by itself. The base software versions are pinned, so they don’t change by accident.

6. If something goes wrong

We would act to contain the problem, work out what happened and fix the cause. If personal data was affected, we would tell the people concerned and the relevant regulators as the law requires.

No website can promise perfect security, and this one doesn’t. Please don’t send passwords, ID documents or payment details through our forms.

7. Report a security problem

If you think you have found a security problem on this site, we want to hear from you. If you follow these rules and act in good faith, we will treat your research as authorized and won’t take legal action against you for it.

In scope

• billionesia.com and www.billionesia.com

Please don’t

• Access, change or delete data that isn’t yours. Stop as soon as you see any, and tell us.
• Run denial-of-service tests or high-volume scans. Please also avoid spam or automated submissions through the forms.
• Test other websites or services on the same server or network, or our suppliers. They aren’t in scope.
• Try social engineering, phishing or physical access.
• Make the problem public before we have had a fair chance to fix it. We ask for up to 90 days.

What to expect

We aim to reply within five business days and to keep you informed while we work on a fix. We don’t run a paid bug bounty, but we are glad to thank you publicly if you would like that. Our contact details for researchers are also at /.well-known/security.txt.