Security Policy Summary
Version: draft-2026-11 ยท Last updated: 1 November 2026
In short
A plain-language summary of how HydroNote protects your data.
Hosting and network
Hosted on Cloudflare with HTTPS for all connections and Cloudflare network protection. Data is encrypted at rest by Cloudflare.
Access control
Every page and data request requires login, except the public website. Roles (operator, supervisor, administrator) are enforced on the server. Accounts lock for 15 minutes after 5 wrong passwords. Sessions expire after 12 hours, and users can log out other devices.
Passwords
Passwords must be at least 10 characters and are stored only as salted PBKDF2 hashes.
Audit trail
Logins, failed logins, data entry, approvals, limit changes, imports, exports and settings changes are recorded permanently.
Data integrity
Readings are checked against limits on the server. Approval requires a second person, and rejections require a reason.
SCADA
HydroNote never connects into customer SCADA networks. SCADA data arrives only as exported files.
Recovery
The database supports point-in-time recovery (Cloudflare D1 Time Travel).
Planned improvements
Two-factor login, independent penetration testing, and assessment against the ACSC Essential Eight.
Reporting a vulnerability
Please email [contact email] with details. Do not test against customer data.