Security measures
Hosting
The website and the customer portal are hosted in France, in the data centres of OVH SAS, société par actions simplifiée.
Isolation between customers
The platform is a multi-tenant SaaS: each customer organisation has a dedicated tenant, isolated from the others, on shared infrastructure. Exercise data — the information system described, suppliers named, assumed vulnerabilities — is sensitive by nature: isolation between tenants is an architectural principle, not a configuration option.
In practice, every piece of data — scenario, exercise, account, report — belongs to a single organisation, and every request is filtered server-side on the organisation of the signed-in account: a user can neither read nor modify another organisation's data. Within an organisation, participants see neither the scenario, nor upcoming injects, nor the scoring grid.
Provisioning and payment
The website you are reading has no access to the database or to the payment provider: it is a static site, with no session. Instances are created and suspended by a dedicated service that is never directly reachable from the web; payment events are logged and then processed idempotently, so that a network incident at the payment provider cannot create a duplicate instance.
Authentication
Passwords are at least 12 characters long and only stored hashed; repeated attempts on an account are slowed down. The second authentication factor (TOTP one-time code) is mandatory for platform administration, and each customer organisation can require it for its administrators. Participants can sign in through their organisation's single sign-on (OpenID Connect SSO). Sessions can be revoked at any time.
Encryption
Traffic to and from the platform is encrypted with TLS 1.2 at minimum, TLS 1.3 preferred, including between the application and its database. Database backups are encrypted (AES-256). Sensitive secrets stored in the database — second authentication factor, customers' SSO configuration — are encrypted (AES-256-GCM); passwords are only stored hashed.
Logging and evidence
An exercise produces a time-stamped timeline of decisions, which serves as evidence in the after-action report. This timeline cannot be changed once the session is closed and can be exported. It is separate from the platform's technical audit log (sign-ins, permission changes, administrative actions), which each organisation can forward to its own SIEM over syslog.
Reporting a vulnerability
Email contact@vordurcyber.com with the subject “[Security]”: the address or feature concerned, steps to reproduce, possible impact. No PGP encryption yet: describe third-party personal data rather than attaching it. See also security.txt.
Scope. The Crisis Room platform and this website. Out of scope: denial of service and load testing, social engineering, physical access, third-party services (hosting, email, customers’ identity providers), findings without demonstrated impact (missing header, version banner, raw scanner output).
Testing rules. Test with your own account (trial account on request). Access another customer’s data only as far as strictly needed for the proof, and stop as soon as you reach personal or exercise data. Do not modify or delete anything that is not yours, do not maintain access, respect rate limits, and keep the finding confidential until it is fixed.
Our commitments. Acknowledgement within 3 working days, initial assessment (validity, CVSS severity) within 10 working days. Fix targeted within 30 days for a critical or high issue, 90 days for others. Disclosure coordinated with you, otherwise 90 days after the report, with affected customers informed first. Public credit if you wish; no financial reward for now.
Good-faith research. We will not take legal action against research that follows these rules; should a third party do so, we would make it known that the research was authorised.