1. Responsibility and scope
Douglas Sutherland administers mrsutherland.net and the public CHARLOTTE demo at charlotte.mrsutherland.net. This policy describes their security approach. It is not a certification, independent audit report, guarantee of complete security or technical-support promise. See the Privacy Policy for information handling.
2. Minimise information held
Classroom tools run in the browser without student or teacher accounts and do not submit learner work to the operator’s servers. Browser saves and exports remain under the visitor’s control. CHARLOTTE uses fictional data and temporary page memory, without a backend connection, real-data imports or server saves. Necessary hosting records and voluntary report emails are separate from learner work.
3. Delivery and providers
Use the HTTPS website and demo addresses. HTTPS protects traffic in transit; it does not remove every browser, device or hosting risk. Common fonts and scripts are served locally, and external media loads by choice. Hostinger provides hosting and Gmail handles report correspondence. Provider security, retention, processing location and availability are partly governed by those providers. No Australian-only hosting assurance is made.
4. Administration standard
The operator’s standard is to use strong, unique credentials; enable multi-factor authentication on administrative services where available; limit administrative access to people who need it; keep credentials out of public files; assess credible security reports; and address confirmed vulnerabilities as reasonably practicable. Features, dependencies and provider changes should trigger a proportionate privacy and security review. Publication changes should retain a recovery path and be checked before and after release. Individual settings and maintenance completion are checked in the administration record. This policy does not assert independent verification of every control, elimination of every vulnerability or a guaranteed repair deadline.
5. Local-device responsibilities
Use an up-to-date browser and operating system and follow your organisation’s device rules. On shared devices, another person using the same browser profile may see local work. Export needed work, keep downloads secure, back up files and clear only saves you intend to remove. The operator cannot remotely delete or recover local projects. Do not enter confidential information in public demos or send it in reports.
6. Report a concern
Email dsuth10@gmail.com with the subject “Website security report”. Include the affected public URL, a plain description, the time observed and minimal non-sensitive reproduction steps. Redact screenshots and use fictional examples. Do not send passwords, credentials, student records, other people’s personal information or malware. Privacy and copyright concerns are also accepted. This is not a technical-support service. Reports are considered according to credibility and likely impact; no response deadline, continuous monitoring or reward programme is promised.
7. Responsible investigation
Stop and report the issue if you encounter information you should not access. Do not retrieve, copy, alter or disclose anyone else’s data, exploit an issue beyond a safe description, disrupt availability or test destructive actions. Contact the operator before active testing that could affect the service or other people. This policy does not authorise bypassing controls or unauthorised testing.
8. Incident response and review
For a credible incident, the operator will assess the report, take proportionate containment steps (which may include taking a feature offline), preserve necessary evidence, involve relevant providers and address confirmed causes as reasonably practicable. Affected people and authorities will be notified where required by applicable law. Reports and incident records are used for that purpose, unnecessary personal information is removed, and retention follows the Privacy Policy and legal requirements. Services may change, be suspended or be withdrawn for security or maintenance. There is no guaranteed uptime, recovery time or technical support. This approach is reviewed when features, providers or material risks change. Non-excludable legal rights and obligations remain unaffected.