Security

Our approach

We take reasonable technical and organisational measures to protect information, consistent with APP 11 of the Privacy Act. Our public website is a static site served over HTTPS through a global content delivery network with strict security headers and a restrictive content security policy, and we apply least-privilege access to our infrastructure and keep dependencies scanned and updated.

Reporting a vulnerability

If you believe you have found a security vulnerability, report it to au@sumr.co with enough detail to reproduce it, and give us a reasonable opportunity to investigate and remediate before any public disclosure.

We will not pursue action against good-faith security research that respects user privacy, avoids service disruption and stays within the scope of what is needed to demonstrate the issue.

Data breach response

We maintain a process to assess and respond to security incidents. Where an eligible data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.

Contact

Security reports and general enquiries: au@sumr.co.