Security

This website

The site is deliberately boring, because boring is the most reliable security property available to a marketing site.

• Static output. Every page is pre-rendered HTML. There is no application server, no database, and no server-side code that processes your input — so there is no query to inject into and no session to steal.
• No third-party code. The site loads no external scripts, fonts, images or stylesheets. A supply-chain compromise of an analytics or font vendor cannot reach visitors of this site, because there is no such vendor in the page.
• No accounts, no cookies. There is nothing to log in to and no session state, so there are no credentials here to lose.
• Minimal data. The early-access form composes a message in your own email client rather than posting to a server we run. We hold what you chose to send, and nothing else.

What BreatheFree must satisfy before release

BreatheFree handles information people would not want disclosed. It is not released, and it will not be released until the following are in place and independently checked:

• Data-flow mapping, threat modelling and a privacy impact assessment completed.
• Authentication built on OAuth/OIDC with short-lived tokens and secure device storage.
• Protected data encrypted in transit and at rest.
• Consent versioning, purpose limitation and revocation enforced on the server, not merely reflected in the interface.
• Verified export and deletion, with completion that can be audited rather than assumed.
• Sensitive notification text off by default, so a lock screen never discloses someone's health status.
• Crash reporting and diagnostics that carry no health-entry payloads.
• Abuse prevention, rate limiting, monitoring and a written incident-response procedure.
• Independent penetration testing of the mobile application, the API and the cloud environment.

These are release gates. If one is not met, the release does not happen.

Reporting a vulnerability

If you believe you have found a security issue in this website or in anything else we run, please tell us at support@tetherhealthgroup.com with "Security" in the subject line.

Please include, as far as you can:

• What the issue is and where you found it.
• Steps that reproduce it.
• What an attacker could achieve with it.

We will acknowledge your report, keep you informed while we investigate, and credit you if you would like to be credited. Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and please do not access or modify anyone else's data, degrade our service, or run automated scanning that would.

We do not currently run a paid bug-bounty programme. We are grateful anyway.