Security and responsible disclosure

Last updated: 04/11/2026

1. Our commitment to security

STARTIA designs and operates its information systems applying Spain's National Security Framework (ENS, Royal Decree 311/2022) for HIGH category systems and the CCN-STIC guides of the National Cryptologic Centre. Management approves and reviews the information security policy every year.

2. Measures on this site

• All communications encrypted with TLS 1.2 and 1.3, HSTS and algorithms in line with guide CCN-STIC-807.
• Mandatory two-factor authentication, passwords protected with Argon2id and lockout after repeated attempts.
• Secure sessions with inactivity timeout and remote session sign-out.
• Cryptographically tamper-evident activity log.
• Strict security headers (CSP, origin isolation) and protection against CSRF, XSS and SQL injection.
• Hardened operating system, database and web server, least privilege and controlled updates.

3. Responsible vulnerability disclosure

If you believe you have found a vulnerability in our systems, report it to seguridad@startia.es (also published in security.txt). Include a description, steps to reproduce it and your contact details.

Please do not access, modify or delete third-party data, do not carry out denial-of-service or social engineering attacks, and give us reasonable time to fix the issue before making it public. We will not take legal action against anyone reporting in good faith under these rules.

4. Advice for customers

STARTIA will never ask for your password or verification codes by phone, email or message. Always access our site by typing its address and, if you receive a suspicious message, call us on +34 919 31 00 00. In Spain, INCIBE offers cybersecurity help on 017.