What we do, checked. What we don't have yet, said.
We checked this in our code, which is private: we can show you in a review. It does not replace an external audit, and we do not have one yet.
Practices checked in the code
Session in an HttpOnly cookie
Page code cannot read it. It lasts 24 hours.
Passwords with bcrypt
We store the hash, never the password.
Database with no public port
Reachable only from an internal container network.
The application cannot change the schema
Its role only reads and writes data; migrations use another.
Encrypted daily backups
AES-256, 14-day rotation and a procedure to restore them in isolation.
Security headers
No third-party framing, no type sniffing and limited browser permissions.
Forms with anti-spam and limits
Per-connection limit; the receipt text is erased once it reaches the CRM.
Measurement only with consent
Unless you accept, Google analytics does not load.
Checked in the repository on 2 November 2026.
What we don't have yet
If you need a security questionnaire to decide, ask us before signing.
- Security certificationsNone.
- External auditNone has been done.
- Measured availability agreementNo history to back it.