Security and Vulnerability Disclosure

• Information travels encrypted (TLS 1.2 or later) and is encrypted where it’s stored.
• Encryption keys are wrapped by master keys in AWS Key Management Service, which rotate yearly. Drive files, Health readings and stored secrets have keys of their own, per space, organisation or person.
• Mirage direct messages and the Authenticator’s passwords are end-to-end encrypted, so we can’t read them.
• Account passwords are stored only as hashes. You can use passkeys, two-step sign-in and sign-in approvals on your phone, and see where you’re signed in.
• Organisations are kept separate from each other, and changes are recorded in audit logs.
• Access to our cloud accounts needs multi-factor authentication.

We run on Amazon Web Services, which holds its own security certifications. We don’t hold certifications of our own, such as ISO 27001 or SOC 2. Our security model explains the detail.

If you find a security vulnerability in Cactive, email support@cactive.com.au with “Security vulnerability report” as the subject. Tell us what you found, where, and how to reproduce it.

We’ll reply to confirm we have it, keep you updated as we look into it, and tell you when it’s fixed. We don’t run a paid bug bounty.

When you look for vulnerabilities:

• use only accounts and organisations you own, and stop as soon as you reach anyone else’s data
• don’t keep, share or change other people’s data
• don’t disrupt the service: no denial of service, spam or automated scanning at volume
• don’t use social engineering or physical access, or test our providers’ systems
• give us reasonable time to fix a problem before you tell anyone else about it

If you follow these rules, we’ll treat your research as authorised and won’t take legal action against you for it.

If you think someone has got into your account, change your password, sign out your other sessions and email support@cactive.com.au. If a data breach is likely to cause serious harm, we’ll tell you, as our Privacy Policy explains.