Security at Astrondo

We build and host booking systems and the sites and APIs around them, which means we're looking after other people's bookings, card payments and personal details most of the time. This page covers who looks after security here, how to tell us if you've found a hole in something, and what we do about it.

Who looks after it

Stephen Riddell-Roberts, the company's director, is the security lead. He's the one who gets the monitoring alerts, deals with incidents, fills in client security questionnaires and answers anything sent to the address on this page. The same contact details are in /.well-known/security.txt (RFC 9116) for tools that look for them.

Found something?

Email ste@astrondo.com and put "Security report" in the subject so it doesn't get lost in the inbox. Tell us what's affected, how to reproduce it, and what you think someone could do with it. If you'd like a mention on this page once it's fixed, say so.

What counts

Ours, so fair game

  • astrondo.com and anything under it
  • SeaRoute, Almanac, AngloTiles and EverPitch
  • Client sites and systems we host

Please don't

  • Denial of service, even a small one
  • Phishing or social engineering of us or our clients
  • Anything physical
  • Bugs in third-party services we don't run
  • Things that only work if you've already got into someone's device or account

Not sure whether something is ours? Ask before you poke it.

What we ask of you

  • Go no further than you need to prove the point. If you can see data that isn't yours, stop there and tell us.
  • Don't knock anything over or slow it down for other people.
  • Give us a fair chance to fix it before you tell anyone else.
  • We don't pay for reports. We will say thank you publicly here if you'd like us to.

What you'll get from us

  • A reply within two working days to say we've got it.
  • Within five working days, whether we think it's a real problem and roughly what we'll do.
  • Serious issues fixed first, with 30 days as the target. If it's going to take longer we'll tell you why.
  • No legal action and no report to the police if you've stuck to the above. If someone else makes a fuss, we'll confirm the testing was authorised.
  • A credit on this page once it's sorted, if you want one.

How we run things

We're a small company, so the setup is kept simple enough to actually stick to.

Logins
Two-factor on every admin login. Admin accounts are separate from the day-to-day ones, access is per system rather than one key to everything, and every credential lives in a password manager rather than a config file or a document.
Servers
Nothing runs on an unsupported OS or runtime. Security patches go on promptly. Admin panels aren't reachable from the internet.
Monitoring
Servers and services are watched round the clock and the alerts go to Stephen.
Payments and traffic
HTTPS everywhere. Card payments go through PCI DSS certified providers, so we never see or store card numbers.
Backups
Automatic, stored away from the servers they came from, and restored now and then to check they actually work.
Code
Dependencies kept up to date, framework security releases followed, and changes reviewed before they go live.
When something goes wrong
Stephen handles it and the clients affected are told straight away. Where personal data is involved we follow the UK GDPR reporting rules.

If you need a supplier questionnaire filled in, or more detail on any of this, email Stephen.

Thanks

Nobody has reported anything yet. When someone does and wants a mention, it'll go here.