Security

How the service is run and protected

This page is for the IT department or the principal who has to approve a new tool. The privacy notice is the formal statement of what data is collected and where it goes. This page describes how the service protects it.

CurveNumber is a small service in active testing. It has not been through an independent security audit, and this page does not claim more than the service does.

Where it runs

• The service runs on Amazon Web Services, on a single virtual machine in the us-east-1 region, which is Northern Virginia.
• Traffic to the service is encrypted in transit. The server's disk and the backup storage are encrypted at rest.
• The database is copied every hour. The server keeps the eight most recent copies. Copies in object storage, in the same region, expire after fourteen days for the hourly ones and ninety days for the daily one. A replaced copy can be recovered for a further fourteen days (hourly) or thirty days (daily), so the longest any backup lasts is about 120 days.
• A continuous copy of the database, a few seconds behind, is kept for three days, and a file it retires stays recoverable for seven more.
• Server and application logs are also copied to Amazon CloudWatch Logs in the same region and deleted there after thirty days.
• Email from the service (password resets, address checks, invitations and reminders) is sent through Amazon Simple Email Service (SES).
• Access to the server is limited to the people who operate it.

Accounts, passwords and keys

• Passwords must be at least twelve characters and are stored with scrypt, never in a form that can be read back. Changing a password signs out every other browser.
• Sessions end 14 days after you sign in, after 24 hours without use, or when you sign out, whichever comes first. The account screen lists every browser that is signed in and offers one control: sign out everywhere.
• API keys are shown in full once and stored only as a hash, so a copy of the database does not yield working keys. Each key can be revoked on its own. Changing a password does not revoke keys, and the screen says so.
• Emailed links for a password reset, an address check or an invitation carry their code in the part of the address a browser never sends to a server, so the code never lands in a server log.
• Sign-in, sign-up and similar routes are rate limited, as are the routes that call outside data services on your behalf.
• Operator screens answer "not found" to anyone who is not an operator, so a visitor learns nothing about what exists.

Secrets and outside documents

• Service credentials are held in a form that prints as a redaction if it is ever logged or shown in an error.
• When the service fetches a document from a web address a user gave it, it checks every address the name resolves to, follows at most three redirects, refuses a switch from HTTPS to HTTP, accepts only web pages, plain text and PDF, stops at 8 MB, and does the work in a separate process that holds no database, mail, billing or model credentials.

What leaves the server

• To read soils, land cover, elevation and rainfall, the server sends your site's boundary, or a point or box around it, to public data services run by United States government agencies. An address typed into the search box goes to the Census Bureau. No name, email address, client name or project name goes with any of these.
• The map tiles are fetched by your own browser directly from USGS, and carry no site data. The typefaces and the mapping library are served from our own server, so no font or code service is contacted.
• When you use the AI assistant, your question and your site's record go to a commercial model vendor, through Amazon Bedrock. It is processed in the United States: the request is made from us-east-1, and AWS may process it in another US region (the privacy notice explains why). Before anything is sent, every email address is replaced by a short code that only makes sense within that site, and the site address and client name fields are withheld.

Two limits, stated plainly. Replacing email addresses with codes hides who someone is; it does not make the record anonymous to somebody who already knows the site. And an address written into free text, rather than into the address field, is not caught. There is also no setting on the vendor's service that means "do not train on this"; that commitment rests on the vendor's commercial terms. The privacy notice lists every recipient in full.

Who can see your sites

• Your account only. Projects and sites belong to the account that made them. Accounts are one person each and nothing is shared between accounts, so a colleague at your firm sees your sites only if you publish one.
• A published link shows only the published page: the report as it was when you published it, optionally behind a password. It does not open the site, its history or anything else on your account, and you can revoke it.
• CurveNumber's operators can open a read-only view of an account to answer a support question. Each look needs a written reason, which is recorded with the operator's name and the time. The view cannot change anything, and it shows no password, key or session.

Companies and services that handle data

Every outside company or service that receives anything from the service or from your browser. The companies that process data for us are also on their own page, companies that handle your data, and the privacy notice gives the detail for each.

Logs: the web server's logs are kept on the server for up to fourteen days, and a copy in Amazon CloudWatch Logs for thirty days.

Reporting a problem

If you find a security problem, write to support@curvenumber.com. It is the one address this service publishes, and it is read.