Our own security
We built this the way we tell clients to build
Every firm in our trade writes security by design on a slide. This page is the version you can verify: how this site is put together, where the data sits, and what is still missing.
Why publish this
Two of our three pillars are hard to prove in a proposal. Security by design and privacy by design are decisions taken early, in places a client never sees, and by the time anyone could audit them the choices have long been made.
So we publish ours. Most of what follows can be checked from your browser in under a minute, without asking us anything. Where a claim cannot be checked from outside, we say so.
What you can check yourself
A content security policy with a nonce, not a wildcard
Scripts run only from this origin, with a random value issued per request, plus the two named third parties below. No inline script without that value, no eval, nothing framed, forms post only to us.
No cookie on any public page
Not one. The language lives in the address, not in a cookie, and there is no consent banner because there is nothing to consent to. The only cookie this site can ever set is the client space session, and it only exists once a client has signed in.
Transport locked down
Strict transport security for two years with subdomains, on the preload list. No mixed content: everything the pages load comes from this origin, fonts and images included.
The browser's own features switched off
Camera, microphone, geolocation, payment, motion sensors and interest-based advertising are all denied by policy, because a brochure site needs none of them.
Where the data actually sits
One server, in Europe
The site, the client space, the chat server and the analytics all run on a single machine inside the European Union. Nothing is sharded out to a platform we do not control.
Mission data in Europe by default, elsewhere if you ask
Documents, evidence and findings from your engagement sit inside the European Union unless you require another jurisdiction. Say so at scoping and we host accordingly, or work entirely inside your own environment.
Analytics we host ourselves, without cookies
Page views are counted by Umami running on our own server. No cookie, no cross-site identifier, no profile, no third-party analytics account holding your visit.
Encrypted chat on our own server
The Matrix server behind our encrypted channels is ours. Messages in an encrypted room are end-to-end encrypted, so their contents are not readable on the server either, by us or by anyone who takes it.
Two third parties, named
Cloudflare Turnstile checks that a form was filled by a person, and Brevo delivers the email we send you. Those are the only outside services in the path, and both are listed in the privacy policy.
Backups, encrypted, for thirty days
The database, the documents and the chat server are backed up nightly, encrypted at rest with a key that is not itself in the backup, and kept for thirty days.
The client space, in detail
No passwords at all
Sign-in is a one-time link sent to a known address. It works once, expires in fifteen minutes, and is stored hashed, so the database holds nothing that could be replayed.
Download links that belong to one person
Each link names the document, the reader and an expiry, and is signed. It cannot be pointed at another file, attributed to someone else, or used after ten minutes.
A six-digit code on confidential documents
For a document marked confidential, no download link is rendered at all. A code goes to the reader's own address, five wrong tries kill it, and the link only exists once the code is right.
Every copy is marked
A confidential PDF is stamped with the address it was issued to and the date, on every page. A leaked copy names its source.
An audit trail you can ask for
Sign-ins, refusals, codes sent and confirmed, downloads: all of it is logged and exportable. So is the list of your open sessions, which you can end yourself.
What we deliberately do not do
No advertising or tracking pixels
No advertising network, no social widget, no remarketing tag, no lead-scoring script watching which pages you read.
No session replay
We do not record your mouse, your keystrokes or your screen. Tools that do are common on consultancy sites and are, in our view, hard to reconcile with a privacy notice.
No content delivery network reading your traffic
Pages are served from our own server. No intermediary terminates the connection to speed up a site this small.
No dark patterns in the forms
One consent box, unticked, that does what it says. We do not pre-tick, we do not bury, and we do not ask for a phone number to send you a document.
Found a vulnerability?
Tell us. Our contact details are published at /.well-known/security.txt, in the place a researcher looks first.
What we commit to: an acknowledgement within two working days, a fix or a plan within thirty, credit if you want it, and no legal action against anyone who reports in good faith and does not degrade the service or touch client data.
What we ask: no automated scanning that affects availability, no social engineering of anyone, and no access to data that is not yours. Report it, do not keep it.
What we have not done
No third-party audit of this site yet
Everything above is our own work, checked by us. No external party has reviewed it. When one does, the findings will be published here, closed or open.
We are not ourselves certified
We take clients to ISO 27001 and we do not hold it. At our size the honest answer is that the certificate would cost more than it would tell you, and we will say so until that stops being true.
One server is one server
There is no second site and no automatic failover. The backups are encrypted and kept off the live path, but they are on the same machine, so a total loss of the server is a real scenario we have priced and accepted rather than solved.
Want this applied to your own build?
Threat modelling at design time, a data protection impact assessment before the first record is stored, and security requirements written into the scope rather than discovered at the end.