How we protect your NewBook API credentials, your account data and your module configuration from unauthorised access.
Your NewBook API key is stored at rest with symmetric AES-256 encryption. The encryption key is kept separate from the data in a dedicated key management system. API keys are never logged in clear text.
Every communication between your browser, the CloudBookMod platform and the NewBook API uses TLS 1.3. Earlier TLS versions are not accepted. HSTS is enabled on the cloudbookmod.org domain.
Staff access to production systems follows the principle of least privilege. Support can view account metadata and billing data but cannot see API keys in clear text. Access to production data requires two-factor authentication.
CloudBookMod undergoes an annual penetration test by an independent security firm. Critical vulnerabilities are fixed within 72 hours. High-severity findings within 14 days.
In the event of a security incident affecting personal data, affected customers are notified without undue delay and within 72 hours when Australian Privacy Principles requires it. A public incident report is published within 30 days.
Spotted a vulnerability? Write to security@cloudbookmod.org with the details. We reply within 24 hours and credit researchers who report valid findings responsibly.