Secure by design
Security was built in from the start, not added afterwards, and is checked before every update:
- No passwords. You sign in with a one-time code sent to your email, so there is no password database to leak and no password to reuse.
- Your bookings are yours. Strict rules decide who may see and change each record: you see only your bookings, an operator only theirs, and people sharing an airport car never see each other.
- Each part can do only its own job. The app on your phone holds no key that opens everything, and each behind-the-scenes task can do one thing only.
- Only our own code runs. The app and this website refuse to run anything that isn't theirs, so something slipped into a page can't do harm.
- Outside information is handled with care. Notices from St Helena Government's website are shown as plain text, and their links can only lead to SHG's own site.
- Encrypted throughout. Every connection is encrypted, and phone alerts are encrypted end to end: the services that deliver them can't read them.
- Nothing to track you with. No third-party analytics, advertising or tracking code, and no cookies.
- Few people can see bookings. Only a small number of staff can, every change to a booking records who made it, and nobody can give themselves more access.
- Data that isn't kept can't leak. Personal details leave bookings 12 months after the trip, automatically.
Report a security problem
If you think you have found a weakness in TransportHub, please email solutions@nextechsthelena.com with:
- what you found, and where (the screen, address or request);
- the steps to show it, and what an attacker could do with it;
- how to reach you, if you would like us to.
Please don't include anyone else's personal data. We'll acknowledge your report within five working days, keep you told while we fix it, and, if you would like, thank you by name when it is fixed. We don't offer payment for reports.
Our contact details for this are also published at /.well-known/security.txt.
Testing in good faith
We won't take action against anyone who looks for weaknesses in good faith and:
- uses only their own accounts, or test accounts we give them;
- stops and tells us as soon as they reach anyone else's data, and doesn't keep, copy or share it;
- doesn't disrupt the service: no load or denial-of-service testing, no spam, no automated scanning that floods it;
- doesn't try to trick or pressure people, including our staff and the operators, or test anything physical;
- gives us reasonable time to fix a problem before telling anyone else.
Problems in services run by others (St Helena Government's website, Supabase, Netlify, the app stores' and phones' own software) should go to them.
If something goes wrong
If your information is ever exposed, we will tell you directly and quickly, say what happened and what we are doing about it, and tell St Helena Government.