How this platform is built to hold what it is given. Everything described here is implemented in the platform today. Where a control is not in place, this document does not claim it.
1What the platform holds
1.1Account records: identity, contact details, jurisdiction and standing.
1.2Engagement material: scope agreements, mission documents, operator findings, evidence artifacts and the messages attached to an engagement.
1.3Operational records: authentication events, audit entries, and the queue history of a request or application.
2Encryption
2.1Sensitive contact details are encrypted at rest with AES-256-GCM, which is an authenticated cipher: material that has been altered fails to decrypt rather than decrypting to something wrong.
2.2Encryption keys are held outside the database and can be rotated without re-collecting anything, using the rotation tooling that ships with the platform.
2.3Passwords, where an account uses one, are hashed with Argon2. They are never stored recoverably and cannot be read back by anybody, including HUNT.
2.4In production the site is served over HTTPS with HSTS, and session cookies carry the __Host- prefix, so they are bound to the exact origin that set them and cannot be written by a subdomain.
3The audit trail
3.1Consequential actions are written to an append-only audit log.
3.2Each entry carries a SHA-256 hash computed over its own content and the hash of the entry before it. Altering or removing an entry breaks the chain from that point onward, which makes tampering detectable rather than merely prohibited.
3.3Reads of client material are recorded, not only writes.
4Evidence handling
4.1Evidence attached to a finding is hashed and timestamped on receipt, so what is examined later can be shown to be what was submitted.
4.2Uploaded files are checked against their declared type by inspecting the file itself rather than trusting its name or the type the browser claimed, and are scanned before they are made available.
5Access control
5.1Access is granted by role against an explicit permission matrix, and is denied by default.
5.2Authentication and clearance to operate are separate: holding a session does not by itself authorise operational work, and sensitive actions require re-authentication at the time they are performed.
5.3Certain actions require two people, and cannot be completed by the person who started them.
5.4Client material is held in collections the operator surface does not query. An unreviewed finding cannot reach a client through a forgotten filter because there is no query path for it to travel along.
6Separation of identity
6.1An operator's legal identity is held apart from the callsign their work is published under, and is not exposed to clients or to other operators.
6.2Verification records are kept separately from the operational record, and access to them is itself audited.
7Your rights over your data
7.1You may request a copy of the personal data held about you, and you may request its deletion. Both are handled through the platform's subject-rights queue and are answered by a person.
7.2Where an account is deleted, a tombstone record is kept noting that the deletion happened, when, and what it covered. It contains no personal data, and exists so the deletion itself can be evidenced afterwards.
7.3Some records cannot be deleted on request where they are needed to evidence an authorised engagement, to meet a legal obligation, or to resolve a dispute. Where that applies, the response says so and says why.
8Reporting a weakness in this platform
8.1HUNT runs a research network; it expects to be researched. Report anything you find in this platform through the enquiry route published on this site, and it will be routed to the security desk.
8.2Do not access, alter or retain other people's data while demonstrating a weakness. Establishing that you could reach something is the finding. Reaching it is not.