Sotozeo: Speeding reconciliations

Sotozeo

Approach		We thought a lot about cyber security before we created this website. We do not hold your money or payment details (nor any health or sensitive personal information), so we do not apply the approach that would be appropriate for a bank, but we do take care of the data that we do hold. We do sometimes check that it really is you logging in by sending you an email for you to authenticate. We do recurrently monitor our files for malware, although something bad might be so well disguised that it is missed. We do recurrently test our security by having white-hat firms to try to break in.
Data we hold		See our Privacy Statement.
It's not 1990		We said we thought about cyber security; we did not just read and copy other people. E.g. There is well-known guidance that in the case of a failed login attempt, the system should not say whether an userid is invalid but just that the combination of userid and password is invalid, because the former discloses whether an account exists for that userid. This has always slightly reduced utility for bona fide users - have I mistyped my userid, or my password? That guidance is valid for systems where user ids are created by the system or by system administrators. It would be valid at Sotozeo if we used your User_Code for login rather than your email address. But it is not valid when you create your own user ID (including those cases when it is your email address) So when you have a failed login in to Sotozeo, we do tell you whether the username (email) has an account or not. This is especially relevant at Sotozeo because you can both create your User yourself, and be created by one of your colleagues.
Bad actors		Having taken appropriate precautions at our end (not disclosed!), many of the remaining cyber risks arise from bad actors trying to impersonate us. E.g. We cannot prevent anybody setting up a website such as scamstz.com, copying our logo and asking for your credit card details. We do have mechanisms for trying to detect some such actions, but they are not guaranteed to work, and would identify unusual patterns only after the fact, so here is information relevant for you to take precautions:
	1	The URL shown in your browser address bar should always be preceeded by a padlock sign as the first (or on Firefox, second) symbol, on which you can click to see security details. The URL shown in your browser address bar should start https://www.sotozeo.com, unless it is a browser such as CCleaner which suppresses the https://www.
	2	All emails from us come from the domains @sotozeo.com or @sotozeo.email (Although note that it comparatively easy for a bad actor to spoof the sending email address to make it look as though it comes from someone other than the actual sender)
	3	When entering your card number for payment, the URL shown in your address bar should begin with: https://checkout.stripe.com/ and should look like this image.
	4	The data on your account at Sotozeo is unlikely to be particularly valuable to any bad actors, either to steal money, or steal your identity. So we do not require a particularly complex password, nor that it is changed regularly. Note that we require 8-20 characters; a mixture of letters and digits (and do not accept special characters). But do use a unique password, so that: if your Sotozeo password is somehow harvested when you use sotozeo.com, it cannot be used to access E.g. a banking website if your password is harvested from another site, nobody can use your Sotozeo credit ! Our not allowing special characters in passwords for Sotozeo reduces the chance of your Sotozeo password being the same as your password on sites which do contain sensitive information/access to money. (this is the equivalent of a garden shed not accepting the type of lock used on a safe deposit box)
Character limitations		Various characters can be used by hackers to mislead programs into behaving wrongly. While many such characters are known, new methods of attack are sometimes discovered. We therefore allow only a pre-defined set of characters to be used; details are set out against each field. E.g. your name can contain only letters and spaces. your password can contain only letters and digits. On the main Input page, Labels that you submit with your data have any special characters replaced. Accepted characters are: letters, digits, and + - _ / We replace ' (single quote) and " (double quote) with ° (degree) We replace , (comma) and ; (semi-colon) with . (period) Any other character is replaced by _ (underscore) In Labels, we replace one character with another rather than using the ASCII escape approach (%20 for space etc.) because this means that those characters which are not changed are in the same position as in your source data, so it is easier if you need to match them up in Excel. In Names we remove . , and ; so A.B.C. S.A. becomes ABC SA As some free advice with applicability beyond Sotozeo, having commas, semi-colons, tabs, and newline characters within any text fields is asking for trouble, even if only that columns misalign when exporting to Excel, so we suggest that in all your systems you do not enter those characters, and clean them when you find them.

::::::::::::::::::::