Trust
Security is treated as an engineering property.
SIATRIX approaches security through architecture, constrained behavior, data minimization and evidence-backed public claims.
Engineering
Secure engineering.
These are the positions SIATRIX engineers from. They describe how systems are designed rather than a claim that every system already implements every control.
- Security considered during design. Trust boundaries, data flow and privilege are examined while the expensive decisions are still open.
- Least privilege. Access should start narrow and widen for a stated reason, because the reverse rarely happens on schedule.
- Clear trust boundaries. Which components trust which, and what crosses between them, should be stated rather than inferred.
- Secure defaults. The path of least resistance should be the secure one. Controls that depend on remembering tend to decay.
- Controlled change. Changes reach production deliberately, with the way they get there treated as part of the system.
- Third-party and supply-chain risk considered. Every dependency is attack surface, so each one should be justified rather than assumed.
- Fail-safe behavior where appropriate. Security-sensitive operations should stop when a control cannot be satisfied.
These sit within the wider engineering position described on theengineering philosophy page, and are applied through the Cybersecurity capability.
Website
Website security and data minimization.
The SIATRIX corporate website is intentionally focused on publishing company, product and engineering information while minimizing unnecessary collection of visitor data.
- No marketing or behavioural analytics.
- No advertising or cross-site tracking.
- No public account or authentication functionality on the corporate website.
- No public submission form.
- Security and privacy are reviewed as the website's functionality evolves, rather than treated as settled.
How SIATRIX handles information on this website is described in theprivacy notice.
Responsible disclosure
Reporting a suspected vulnerability.
If you believe you have found a security vulnerability affecting a SIATRIX-owned public system or product, please report it tosecurity@siatrix.com. This address is also published at/.well-known/security.txt.
What helps in a report
Send whatever you reasonably have. A clear report is more useful than a complete one, and none of this is a precondition for getting in touch.
- The affected SIATRIX URL, product or asset.
- A clear description of the suspected vulnerability.
- Steps to reproduce it, where reproduction is possible.
- The security impact you believe it could have.
- Screenshots, logs or other proof that helps explain the issue.
- Any further context needed to understand or reproduce it.
Researching responsibly
Security research is welcome, and these are the expectations that come with it rather than a grant of authorization or a legal position:
- Avoid disrupting services, degrading availability or testing for denial of service.
- Avoid destructive testing.
- Avoid social engineering and physical intrusion.
- Avoid accessing, modifying, downloading or retaining more data than is reasonably necessary to demonstrate a suspected issue.
- If testing exposes unexpected sensitive data, stop at that point and include it in the report.
- Allow a reasonable opportunity to investigate and address a report before disclosing it publicly.
SIATRIX does not currently operate a bug bounty or reward programme, and does not publish response or remediation timelines. Reports are assessed on their merits, and not every report will turn out to describe a vulnerability.
Evidence
Evidence-backed trust.
Trust depends on claims that can be supported. SIATRIX favors clear statements about current status, capability and scope over broad assurances.
- Certifications are published only when achieved.
- Formal partner status is published only when established.
- Product capability is described according to its verified state.
- Development status is stated clearly wherever a product appears.
- Design direction is distinguished from current product capability.
Product
SIATRIX Security Engine.
SIATRIX Security Engine is an in-development product initiative within theCybersecurity capability. Its product page describes the initiative's current scope and status.