Encryption in transit
Traffic to our websites and services is served over TLS. Connectivity products encrypt traffic between the client and our infrastructure.
Security
How we approach security
Security is part of how we build and operate systems rather than a stage at the end. This page describes the practices we apply and how to report a problem to us.
Least privilege
Access to systems is granted per role and reviewed. Administrative access is separated from routine operational access.
Data minimisation
Systems are designed to collect and retain only what is needed to operate the service, which limits what any incident could expose.
Patching and updates
Operating systems, runtimes and dependencies on infrastructure we operate are kept updated as part of routine maintenance.
Separated environments
Development, staging and production are kept apart, so changes are exercised before they reach live systems and real data.
Monitoring
Systems we operate are monitored for availability and for unexpected behaviour, so problems surface from our side rather than a customer’s.
Reporting a vulnerability
If you believe you have found a security vulnerability in this website, in our infrastructure or in software published by STAR SOURCE LTD, we would like to hear about it.
Please include, where you can:
- The affected website, product or endpoint
- A description of the issue and its likely impact
- The steps needed to reproduce it
- Any logs, requests or screenshots that help demonstrate it
Send the report through our contact form with “Security report” as the subject, or by email to support@starsource.uk.
What we ask
Please give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly. Please do not access, modify or delete data belonging to other people, degrade our services for other users, or run automated scanning that generates significant load.
We do not currently operate a paid bug bounty programme. We will acknowledge reports we receive and keep you informed while we work through them.
This page describes practices, not certifications. STAR SOURCE LTD does not currently hold or claim any third-party security certification, and we will only state otherwise here once that changes.