Last updated 28 October 2026
We look after other businesses’ systems, so we take the security of our own seriously. This page summarises, in general terms, how we protect the systems we run and explains how to report a security problem to us.
1. How we protect our systems
- Australian hosting. Our websites and servers are hosted in Australia, with encrypted off-site backups.
- Restricted administration. Administrative access is limited to a private, authenticated network, using individual accounts and strong authentication.
- Encryption. All traffic to our websites uses HTTPS, and backups are encrypted before they leave the server.
- Patching and hardening. Systems are patched regularly, unnecessary features are disabled, and configuration changes are reviewed.
- Monitoring. We monitor for failures and suspicious activity and review security reports regularly.
- Secrets management. Credentials are kept in an encrypted secrets manager rather than in code or email.
- Recognised frameworks. Our controls are guided by the Australian Signals Directorate’s Essential Eight.
2. Reporting a vulnerability
If you believe you have found a security vulnerability in a website or system operated by ANSR Tech, please email info@ansrtech.com.au with “Security report” in the subject. Please include:
- the address or system affected;
- a description of the issue and how you found it;
- steps to reproduce it; and
- how we can contact you.
Our machine-readable contact details are published at /.well-known/security.txt.
3. What to expect from us
- We aim to acknowledge your report within a few business days.
- We will keep you reasonably updated while we look into it.
- With your permission, we will credit you once it is resolved.
We don’t currently offer payment for reports.
4. Guidelines for testing
Please:
- only test systems operated by ANSR Tech, not our clients’ systems or third-party services we use;
- avoid accessing, changing or deleting data that isn’t yours, and stop as soon as you reach personal or confidential information;
- not use denial-of-service attacks, automated scanning that degrades service, spam, social engineering or physical attacks;
- not use our contact form to test spam filtering; and
- give us reasonable time to fix the issue before telling anyone else.
5. Safe harbour
If you act in good faith and follow these guidelines, we don’t intend to take legal action against you for your research.