Security

What runs this website

This domain serves static files. There is no application server and no database behind it, which removes most of what a reviewer would otherwise need to ask about.

GitHub Pages hosts the files and serves them over HTTPS, so nothing on this domain executes on a server we run. Cloudflare is the registrar and runs the nameservers. The enquiry form is handled by Formspree, which emails submissions to us rather than storing them on this site. Analytics is GA4, cookieless by default; the cookie-setting version loads only if you accept the notice.

How we handle the personal data in an enquiry, and how long we keep it, is in the Privacy and Cookie Policy.

Reporting a vulnerability

If you have found a security problem in one of our systems, we want to hear about it. We will not come after you for telling us.

Our Vulnerability Disclosure Policy sets out what is in scope and the safe harbour we offer. It also commits us to timelines: acknowledgement within two business days, then a remediation window set by severity.

The machine-readable version is at /.well-known/security.txt, published to RFC 9116.

If you are reviewing us as a supplier

We are a small company, so beyond Cyber Essentials Plus our controls are documented, not certified. These are held internally and we will share them on request, under an NDA where you need one:

• Incident Response Plan. How a confirmed live incident is handled, including who gets told and when.
• Supplier Register, listing the third parties we use and what each one processes.
• Data Retention Schedule - what we keep, for how long, and why.

Anything specific to an engagement is a conversation rather than a page. Where your data would live, who would have access to it, what we would sign up to contractually: the answer depends on what we are building and where it runs. Ask us early. We would rather deal with it before a proposal than after one.