Security at geoDB

Your exploration data is commercially confidential, and some of it is market-sensitive before you disclose it. We treat it that way.

Who is responsible

geoDB is built and operated by Aqua Terra Geoscientists LLC. Security is led by Joshua White, President, Aqua Terra Geoscientists LLC.

Report a vulnerability

If you believe you have found a security problem in geoDB, email [email protected] with a description and the steps to reproduce it. We read every report, will confirm we received it, and will keep you informed while we fix it.

While you look, please:

• test only with your own account and your own data, and never access, change or delete anyone else's;
• avoid anything that degrades the service for others, such as denial-of-service or heavy automated scanning;
• give us a reasonable chance to fix the problem before you disclose it publicly.

We do not run a paid bug bounty. The machine-readable contact is at /.well-known/security.txt.

How your data is protected

• Separation between customers. Each customer's data is tied to their company and projects, and access is checked against them. We test that one customer cannot read or change another's data, and an ongoing internal security audit maps and checks every route to the data.
• Hosting and encryption. geoDB runs on Microsoft Azure in the United States. Traffic is encrypted in transit with HTTPS, and the database and file storage are encrypted at rest.
• Backups. The production database keeps point-in-time backups for 30 days.
• Uploaded files. Files that land in geoDB storage are scanned for malware.
• Secrets. Passwords, keys and credentials for our systems are held in a managed key vault, never in our source code.
• Sign-in. Two-factor sign-in is available for every account.
• AI access. When you connect an AI assistant to your data, it works through a grant that you can scope and revoke at any time, and every call it makes is recorded in your access log. What it reads is copied to that assistant, and that copy is governed by its provider's terms, not ours.
• Software updates. Our dependencies are pinned and checked against published vulnerability databases.

Questions about security that are not a vulnerability report: contact geoDB.