Security
Security Practices
How we protect our websites, our code and the information you share with us.
Our team comes from defence and signals intelligence, so we treat security as part of the engineering, not an add-on. This page describes what we do today, and we will add to it as 291 Group grows.
Our websites
- All traffic is encrypted with HTTPS, and browsers are told to always use it.
- Our websites sit behind Cloudflare, which filters attacks and abusive traffic before it reaches our server.
- Strict browser security settings limit what any page can load or run.
- Restricted areas need an access code or are limited to approved networks, and repeated failed attempts are blocked automatically.
- We collect very little: no visitor accounts and no advertising trackers. Our Privacy Policy explains what we do collect.
Our code
- Passwords, keys and other secrets are kept out of our source code, and we check our code for leaked secrets.
- Our open source tools are public, so anyone can read exactly what they do.
- Every change is tested before it goes live.
Our products
- Our open source tools run on your own hardware, with no account and no cloud.
- 291 AMS is passive: it only receives, and gives away no signal of its own.
Reporting a security issue
If you find a security issue in our websites or products, please tell us through our contact page, with enough detail for us to reproduce it. Please give us reasonable time to fix it before sharing it publicly.