Security
A chapter keeps its members' contact details, money, incident reports and hazing-prevention records here. This page says what is done to protect them, one claim at a time, and what isn't done yet. Every claim below is checked by a test in the code.
What TOUSE does
- Each chapter's data is kept apart from every other chapter's. Every read and write goes through a client that adds the chapter to every query, and a test signs in to one chapter and tries, and fails, to reach another's records.
- There are no passwords. You sign in with your email address and a one-time code that is stored hashed, expires in five minutes, and dies after three wrong tries; requests for codes are rate limited.
- Sensitive details (GPA, dietary and medical notes, emergency contacts) are only sent to the roles that may see them. They are removed on the server, not just hidden on the page.
- An anonymous concern report stores nothing that identifies who sent it: no account, no address, no device. A test looks at every column of the database and at everything written to the logs.
- An anonymous vote stores no voter, no time and no order. The database itself refuses to store a voter on an anonymous poll, even if the application were wrong.
- Files are kept in a private store and are only ever handed out through a link that works for one minute, created after TOUSE has checked you may open that file.
- Privileged actions (changing a role, approving a risk plan, adjusting points, recording or reversing a payment, exporting data) are written to an audit log that the application cannot edit or delete.
- Money is whole cents, never decimals. A balance is the sum of ledger entries, and a mistake is corrected by a new reversing entry, never by editing history.
- A chapter's president can download all of the chapter's data. Erasing a person and deleting a chapter are documented, show what they will do before they do it, and are logged.
What it doesn't do yet
- TOUSE has not yet had an independent security review or a penetration test.
- TOUSE does not process card or bank payments today. Dues are recorded by a treasurer; online payment is not built.
- Automatic error monitoring is not connected yet, so a failure is found in the server log rather than reported to a service.
- Backups are kept by the database host for its own retention period. Deleting a chapter does not shorten that.
- TOUSE stores records. It is not a compliance authority: a chapter is responsible for following its national organization's, its university's and the law's rules.