System map

System map

What the Lab website is made of, what is public and what is private, and every address it answers.

This map shows the Lab website as it runs: a static site, one small API for the forms and the answer checker, and the email that a visitor can ask for. There are no accounts, no sign-in and no cookies on this site. The periods in the tables below are the ones of the privacy notice.

Map

The internet on the left, the public zone in the middle, the private zone on the right, one boundary between the zones.

Public zonePrivate zone
System map of SectraTEK Lab The visitor browser reaches CloudFront, the one front door, which serves the static site from a private storage bucket and passes the form and checker calls to the Lab API under /lab-api/v1. Across the boundary, the Lab API writes to the private Lab tables and reads the answer keys. A background service sends the queued mail through the email service: the newsletter confirmation and welcome to the visitor's mailbox, and one notice per question to the research mailbox. The site build uploads the reviewed site to the bucket. CloudFront and the Lab API write logs. Dataset files are static files on the site. The SectraTEK product is a separate system and is not connected. PUBLIC ZONEReachable from the internet PRIVATE ZONENo public address. Visitors never reach it directly BOUNDARY INTERNET SectraTEK.com Main site. Links to the Lab and back, nothing else Other sites (external) Public projects, such as on GitHub. Reached by a link only Visitor browser No sign-in, no cookies Progress stays here Visitor’s mailbox Only if the visitor asks for the newsletter CloudFrontTLS, firewall,security headersone front door Static site (S3)Private bucket. Only CloudFront reads it Pages and assetsHTML, CSS, JS, images Search indexBuilt with the site FeedsRSS, Atom, JSON Site mapFor search engines Lab API: /lab-api/v1 Same origin only. JSON only. Rate limited POST /participants POST /participants/delete POST /challenges/<id>/check POST /ask GET and POST /newsletter/confirm GET and POST /newsletter/unsubscribe Any other address: not found Sets no cookie and reads none How to read this Request or data flow Link only, no data Crosses the boundary nSee the list below Site build Reviewed pages, built and uploaded by a deploy step Staff tools On a separate staff host. Not part of this site Lab tables (private) Participant form entries Questions to the Lab Newsletter addresses and the do-not-mail list Rate-limit hashes, 1 day No IP address, no user agent Answer keys Kept with the API, never in a page Logs Access logs 30 days Firewall logs 3 months Lab API log 3 months, prefix only Background service Sends queued mail, deletes data when its period ends Email service (Amazon SES) From the newsletter address or the notice address Research mailbox A person reads each question and answers by hand 1 2 3 4 5 6 7 8 9 10 11 12 13 14 SEPARATE SYSTEM. NOT CONNECTED TO THIS SITE The SectraTEK product is a separate system. It never reads from, writes to or depends on this site. No line on this map reaches it, and nothing published here changes what the product detects.

Scroll the map sideways. The numbered list below describes every line.

Every line, in words

The same map as a list, for screen readers and for printing. Numbers match the circles on the map.

  1. 1Visitor browser to CloudFront. Every request goes through one front door over HTTPS: pages, search, the forms and the answer checker. The firewall and the security headers apply to all of them.
  2. 2SectraTEK.com and the Lab. The main site links to the Lab and the Lab footer links back. Links only, no data.
  3. 3Visitor browser to other sites. Some pages link to public projects on GitHub and other sites. The visitor leaves this site, and the Lab sees nothing of what happens there.
  4. 4CloudFront to the static site. Pages, assets, the search index, the feeds and the site map are static files in a private bucket that only CloudFront can read.
  5. 5CloudFront to the Lab API. Calls to /lab-api/v1 on the same address as the pages. Nothing is cached. The form and checker calls are accepted only from the Lab’s own pages and only as JSON, and the API limits how many calls a network can make.
  6. 6Lab API to the Lab tables. Crosses the boundary. The API stores a participant form entry, a question or a newsletter request, and deletes an entry when its id is sent. It stores no IP address and no user agent.
  7. 7Lab API to the answer keys. Crosses the boundary. The checker reads the key of one challenge and returns which answers are right, the score and a hint for a wrong answer. It never returns an answer and does not keep the answers it checks.
  8. 8Lab tables to the background service. The service picks up mail waiting to be sent and deletes data when its period ends.
  9. 9Background service to the email service. Each message is handed to Amazon SES.
  10. 10Email service to the visitor’s mailbox. Crosses the boundary. Only when a visitor ticks the newsletter box and gives an address: one confirmation message, and a welcome message after the confirmation. Both come from the SectraTEK newsletter address and carry an unsubscribe link.
  11. 11Email service to the research mailbox. One notice for each question sent through Ask the Lab, from the SectraTEK notice address. Nothing is sent to the visitor. Staff answer by hand from their own mailbox.
  12. 12Visitor’s mailbox to the browser. The confirm and unsubscribe links open a page with a button. Opening a link changes nothing; pressing the button does.
  13. 13Site build to the static site. Crosses the boundary. The only thing that goes from the private zone to the public one is the built site. Nothing on the site can write to the bucket.
  14. 14CloudFront and the Lab API to the logs. Crosses the boundary. The access and firewall logs hold the full IP address; the Lab API’s own log holds the kind of request, the result and the IP address cut to a prefix, never the content.

Addresses

Every address the Lab site answers. All of them are anonymous: there is no account and no sign-in. Staff tools are on a separate host and are not part of this site.

Every address: method, path, access, data, who calls it, notes
MethodPathAccessDataCalled byNotes
Static site (CloudFront to the bucket)
GET/ and /*AnyoneHTML, CSS, JS, images, fontsVisitor browserNo cookies are set. Pages are checked for a new version on every visit.
GET/assets/search-index.jsAnyoneTitles and descriptionsSearch boxBuilt with the site. Searching happens in the browser.
GET/feed.xml, /atom.xml, /feed.jsonAnyoneResearch articles and open-source postsFeed readersBuilt with the site.
GET/assets/research/<id>/*AnyoneAppendix data of an articleArticle pagesPublic by design.
GET/sitemap.xml, /robots.txtAnyonePage listSearch engines
Lab API (CloudFront to the API, never cached)
POST/lab-api/v1/participantsThe Lab’s own pages. Rate limitedRole, experience; optional country, interests and how you heard of us; newsletter choice; an email only with the newsletter box; consent version; the challenge you were onAbout you form, form after a challengeReturns the entry id once. Stores no name and no network data. The email goes only to the newsletter list.
POST/lab-api/v1/participants/deleteThe Lab’s own pages. Rate limitedThe entry idDelete my answers buttonDeletes the entry. The answer is the same whether the id existed or not.
POST/lab-api/v1/challenges/<id>/checkThe Lab’s own pages. Rate limitedThe answers for one challengeChallenge pagesReturns right or wrong, the score and a hint for a wrong answer. Never returns an answer. Answers are not stored.
POST/lab-api/v1/askThe Lab’s own pages. Hidden field, fill time, rate limitTopic, question, optional name and email, public or private answer, the confirmation boxAsk the Lab formWords only: no files. Stores the question and sends one notice to the research mailbox. Returns a reference.
GET/lab-api/v1/newsletter/confirmLink tokenThe token in the linkLink in the confirmation messageShows a page with a button. Opening the link confirms nothing.
POST/lab-api/v1/newsletter/confirmLink tokenThe tokenThe button on that pageConfirms the subscription, then shows the confirmed page. The welcome message follows.
GET/lab-api/v1/newsletter/unsubscribeLink tokenThe token in the linkLink in every Lab messageShows a page with a button.
POST/lab-api/v1/newsletter/unsubscribeLink tokenThe tokenThe button, or the one-click unsubscribe of a mail programRemoves the address from the list, then shows the unsubscribed page.
Any/lab-api/*, any otherAnyoneNoneAnswers “not found”.

What is public, what is private

Public and private data
ItemZoneNote
Research articles, technical reports, figures, appendix dataPublicStatic files, CC BY 4.0 unless a page says otherwise.
Dataset pages, reference answers and checksumsPublicThe pages and the files are on this site, as static files.
Challenge pages and questionsPublicThe answer keys stay with the API and are never in a page.
Answered-questions archivePublicOnly questions the sender agreed to publish, edited.
Questions to the Lab, with the optional name and emailPrivateKept in a private table and sent to the research mailbox. Never on the site.
Participant form entriesPrivateNo name, no address, no network data.
Newsletter addresses and the do-not-mail listPrivateUsed only to send the Lab newsletter.
Answer keysPrivateRead only by the answer checker.
Rate-limit hashes and logsPrivateFor running the site and stopping abuse.

Data we keep, and for how long

Data kept and retention
DataWhyKept for
Challenge progress, typed answers, hints opened, entry idYour own progressIn your browser only, until you clear it
Ask the Lab question, optional name and emailTo answer, and to publish if agreedText, name and email 12 months after we answer, or after we receive the question if no answer is recorded. The record of the request, without the text, 24 months.
Participant form entry (no name, no address, no network data)To learn who uses the challenges24 months, or until the person deletes it
Unconfirmed newsletter requestDouble opt-in7 days
Confirmed newsletter addressTo send the newsletterUntil the person unsubscribes, then a minimal record so we do not write again
Challenge answers you checkChecking the answerNot kept. The server checks and discards them.
Rate-limit hashes (salted, changed daily)Abuse control1 day
Access logs (CloudFront, storage, load balancer): full IP address and full web addressRunning the site, stopping abuse30 days
Security logs (firewall): full IP address, no query stringStopping abuse3 months
The Lab’s own server log: request kind, result, IP address cut to a prefixRunning the site3 months
Backups of the databaseRecovery35 days

These periods are the ones of the privacy notice, version 0.4, which is not in force yet.

UpDownto moveEnterto openEscto close