Security

• Sign-in is through Cloudflare Access to the organisation’s own identity provider, where the organisation sets its own multi-factor authentication policy. Substriva stores no passwords.
• Every workspace request is checked again by Substriva itself: the signed sign-in token (issuer, audience, expiry, signature) and then an active, individually linked membership. If sign-in is not configured, the workspace shows nothing.
• Roles are separate: administrator, contributor, reviewer, read-only. Publishing needs a separate, revocable grant. Nobody can review their own submission; this is enforced by the application and again by the database.
• There is no Substriva “support” back door. If Substriva staff need to see a workspace, they are added as a read-only member with the organisation’s agreement, visibly, and removed afterwards.

Every private query is bound to the signed-in person’s organisation. Another organisation’s records are reported as not found, so their existence cannot be probed. This is covered by automated tests that try guessed identifiers and altered requests, including for exports, imports, GIS connections, imagery and parcel lookups.

• Read-only. Substriva only ever reads layer metadata and features; it has no code that edits a council service.
• A host must be approved for your organisation before any layer on it can be connected. Only https on the standard port is accepted; IP addresses, internal names and redirects are refused; every request has a time and size limit.
• Credentials (for example an ArcGIS token or imagery key) are deployment secrets referenced by name, scoped to one organisation, added on the server and never sent to the browser, stored in the database or written to logs.

• Encryption in transit: HTTPS everywhere, with HSTS.
• Hosting: Cloudflare (Pages, Workers, D1 database, R2 storage). Cloudflare states that D1 data is encrypted at rest with AES-256 in GCM mode, and that D1 keeps point-in-time recovery history (up to 30 days on paid plans).
• Location: Cloudflare runs a global network and does not state a location for D1 in its data-security documentation. Substriva does not currently guarantee that data stays in Australia. The database location will be stated in any pilot agreement.
• Workspace imports: the original file stays on the uploader’s computer; Substriva keeps the features chosen for import and a SHA-256 fingerprint of the file. Evidence files attached to workspace records are fingerprinted, not uploaded. (Photos sent through the public community-evidence form are different: they are stored privately for review, as the Privacy page describes.)
• Audit: an append-only log records workspace openings, connections added and revoked, uploads, managed areas, submissions, reviews, publications and exports, with the signed-in identity. Individual map tile and feature reads are not logged.
• Export: your organisation can export all of its managed areas, sources and evidence status at any time (GeoPackage, GeoJSON, CSV), and each record’s complete history with integrity hashes.

A strict content security policy, HSTS, clickjacking and MIME-sniffing protection, and a restrictive referrer and permissions policy. No advertising or third-party analytics scripts. Cloudflare Turnstile is used on the public community-evidence form to deter automated abuse.

Write to hello@substriva.com.au. Please include enough detail to reproduce the issue and do not access other organisations’ data while testing. If we become aware of unauthorised access to an organisation’s data, we will tell that organisation’s nominated contact; timeframes and responsibilities are set in the pilot agreement.

The Office of the Victorian Information Commissioner does not certify contracted service providers under the Victorian Protective Data Security Standards. Where an engaging council or agency requires VPDSS-aligned controls, those requirements are agreed in the contract and can be assessed against this page.