Security and privacy
How we secure our platforms and handle data. This website itself collects almost nothing; what applies per platform is stated on that platform.
This website
On Theos Group you cannot create an account and there is nothing to purchase. We measure visit statistics without building profiles and without selling data to third parties, and we do not use advertising cookies. If you send us a message via the contact form, we retain it only to be able to reply to you.
Behind the login is only our own dashboard. No accounts are issued for third parties.
Collect as little as possible, everywhere
That is not only policy for this site but the principle on every platform: only ask what is necessary to deliver the service, and on every platform the ability to export everything or have it deleted.
With PSILY this goes the furthest: the contents of the digital vault are encrypted in the user's browser before reaching us. We store encrypted blocks and not the key — we cannot read those messages.
Technology
Everything goes over https with HSTS, behind Cloudflare. Passwords are stored hashed, sessions are in the database, and two-factor verification is available on every platform via email or sms — for everyone, and never mandatory.
An encrypted backup is made daily, and that backup is automatically restored in a test. A backup you have never restored is not a backup but an assumption.
Each platform runs its own nightly security round and reports what is wrong. What comes out of that appears in the daily report the next morning.
Found something?
If you see a security issue on one of our platforms, report it via office@theosgroup.net. We respond and keep you informed of what we do about it. Do not publish it before it is fixed — for services where people record their legacy or their medical situation, that directly affects the wrong people.