Security

Our approach

Security is part of how we build and run software, for our own systems and for our clients. We follow widely recognised practices, including the OWASP guidance for web and mobile applications and the Australian Cyber Security Centre’s Essential Eight, scaled to the size of each system.

This website

• Served only over HTTPS through Amazon CloudFront, with modern TLS.
• A static site with no user accounts, no payments and no database.
• No third-party scripts, advertising or tracking.
• Hosted on Amazon Web Services with restricted, multi-factor-protected administrative access.

How we work

• Multi-factor authentication on every business, code and cloud account.
• Least-privilege access, with separate test and production environments.
• Encryption of data in transit and at rest.
• Secrets kept in managed secret stores, never in source code.
• Regular dependency and operating system updates, and automated vulnerability scanning of code.
• Backups tested for restoration, and logs retained for investigation.
• Client information kept confidential and removed from our systems when no longer needed.

Reporting a vulnerability

If you believe you have found a security vulnerability in this website or in software published by Gumtree Hill Solutions, please email support@gumtreehillsolutions.com with the subject “Security report”. Please include:

• the affected website, app or product, and version;
• a description of the issue and steps to reproduce it;
• the potential impact, as you understand it.

We will acknowledge your report within two business days, keep you informed of progress, and let you know when the issue is resolved.

Please act in good faith: do not access or change other people’s data, do not degrade the service, and give us reasonable time to fix the issue before disclosing it publicly. We will not take legal action against researchers who follow these guidelines. A machine-readable contact is available at /.well-known/security.txt.