ET
ETSS

Security

Security Policy

Last updated: July 2026

1. Our Security Commitment

ETSS handles sensitive legal information including Employment Tribunal case data, witness statements, and financial records. Security is an architectural priority — not an add-on. All data is stored in the UK (AWS eu-west-2, London) and protected by industry-standard encryption.

2. Infrastructure Security

  • Encryption in transit: TLS 1.3 minimum. HSTS enforced. All HTTP redirected to HTTPS.
  • Encryption at rest: AES-256-GCM for all documents (S3 SSE-S3). Database encryption enabled.
  • Data residency: All data stored exclusively in AWS eu-west-2 (London, UK).
  • Access control: JWT authentication, role-based access, case-level data isolation.
  • Document access: Pre-signed URLs with 15-minute expiry. No public access to any storage bucket.
  • Backups: Automated daily database backups with 7-day retention.

3. Application Security

  • Input validation on all API requests (Zod schema validation)
  • Parameterised database queries (SQL injection prevention)
  • CORS restricted to application domain only
  • Rate limiting (100 req/min authenticated, 20 req/min public)
  • Password hashing with bcrypt (work factor 12)
  • JWT token rotation with 15-minute access token TTL
  • Immutable audit logging of all case mutations

4. Responsible Disclosure

If you discover a security vulnerability in ETSS, we ask that you:

  • Report it to security@modellawoffice.co.uk
  • Do not exploit the vulnerability or access other users' data
  • Do not publicly disclose the vulnerability until we have addressed it
  • Provide sufficient detail for us to reproduce the issue

We commit to:

  • Acknowledging your report within 48 hours
  • Providing a timeline for resolution
  • Keeping you informed of our progress
  • Not pursuing legal action against good-faith security researchers

5. Scope

The following are in scope for responsible disclosure:

  • Authentication and authorisation bypasses
  • Cross-site scripting (XSS)
  • SQL injection or data leakage
  • Insecure direct object references (accessing other users' cases)
  • Server-side request forgery (SSRF)
  • Privilege escalation

Out of scope: denial of service attacks, social engineering, phishing, physical attacks.

6. Contact

Security reports: security@modellawoffice.co.uk

General support: support@modellawoffice.co.uk