Security

Of Record publishes public records, so the sensitive surface is small and specific: email addresses, account records and payment identifiers. This page says how those are handled and how the service is built. Last updated 2026-09-26.

What data exists, by sensitivity

Data	Sensitivity	Handling
The council record	public by nature	published; also the basis of the paid products
Subscriber email addresses	personal	stored on the service machine, never shared or sold
Customer accounts and users	personal	stored on the service machine; no passwords exist
Session and login tokens, API keys	credential	stored as SHA-256 hashes; plaintext shown once, never recoverable
Card details	payment	never received — Stripe Checkout holds them

Authentication and access

No passwords anywhere. Signing in is a single-use link, valid twenty minutes, sent to the account's own address.
Sessions are HttpOnly, Secure cookies, thirty days, revocable.
API keys are issued per account, prefixed ofr_, metered per call, rate-limited, and revocable immediately from the account.
State-changing requests must originate from the site itself; login attempts are rate-limited per address, and every address gets the same answer so the form cannot be used to discover who is a customer.
Administrative access is on the machine itself, not over the internet.

How the service is built

Each service is a separate process on its own loopback port, reached from the internet only through a Cloudflare tunnel; no service listens on a public interface.
The public record is served as static files. The paid services read a consolidated index read-only and cannot write to it, so a fault in a paid product cannot alter or slow the public record.
Dependencies are the Python standard library. There is no web framework, no ORM and no package tree to inherit a vulnerability through.
Payment events are authenticated by signature, not by trust in the caller.

Where data lives, and backups

The record, accounts and subscriber addresses are stored in Ontario, Canada. Backups run twice daily to on-premises storage in the same province, plus hourly system backups, and are verified rather than assumed: the record's object store is content-addressed, so each backed-up file is checked against the hash that is its own filename.

Sub-processors are named in the privacy page: Google Analytics, Resend, Stripe and Cloudflare. No other party receives customer or subscriber data.

Availability, and what happens when something breaks

The public sites are static and served from a single machine with an automatic monitor that checks them from outside and alerts the operator within fifteen minutes of anything stopping — the nightly failing, the collector going quiet, a site not answering, a backup falling behind, or the disk filling.

No formal uptime guarantee is offered at present; an enterprise agreement can include one. Say so during procurement rather than assuming it.

Incidents and disclosure

Report a vulnerability to [email protected]. Reports are acknowledged within two business days and the reporter is told what was done. There is no bounty programme; there is a prompt reply and credit where it is wanted.

Affected account holders would be notified by email without undue delay, along with the Privacy Commissioner where the law requires it.