Security & Compliance
Posture, data handling, regulated claims, and accessibility — enforced automatically, not remembered.
Compliance fails most often not through defiance but through drift: a disclosure that was correct when it was written, a claim that acquired a legal requirement after it was published, an accessibility standard met at launch and eroded by twelve subsequent edits. The premise here is that a requirement enforced by a person's memory is a requirement that has already been lost.
The work covers security posture and data handling, regulated claims and their required disclosures, accessibility, and the mechanisms that keep all three from decaying.
Claims and their conditions are a single object. A financing rate, a warranty term, an efficiency rating, a guarantee, a price — each renders only through a component that forces its accompanying disclosure to render with it. A claim whose paired disclosure is absent fails the build. This is the difference between a policy that disclosures must accompany claims and a system in which an unaccompanied claim cannot exist.
The remedy for a claim that cannot carry its disclosure is to remove the claim, not to shrink the disclosure. Where a disclosure is genuinely too long for the page, the claim and the disclosure move together to the page that owns them and the original keeps the argument and a link. Removing the trigger is a real option and it is frequently the right one.
Data handling is designed around collecting less. A field that is not collected cannot be breached, cannot be mishandled in transit, cannot be retained too long, and cannot appear in a log. Every field on every form is justified by what it is for, and free-text fields that may contain sensitive detail are redacted from logs, not trusted to be innocuous.
Accessibility is measured. Contrast ratios are computed from actual values and recorded, focus states exist on every interactive control rather than most of them, and keyboard navigation is tested by using it. An accessibility statement that describes intentions rather than measurements is a liability written in the first person.
Security posture for the systems the firm builds is deliberately narrow: little third-party software, no unnecessary data, everything a visitor can send checked on our side before it is trusted, and credentials held outside the code. This is not a certification and it is not described as one. It is a set of practices that can be inspected.
Where a requirement comes from a specific statute or a licensing body, we record the source and the date it was verified, and treat anything drafted from general knowledge as unverified until a source is attached. Legal wording that is prescribed is reproduced exactly rather than improved, because improving prescribed wording is how a compliant disclosure becomes a non-compliant one.
7 pages.
Claims and their disclosures
A claim and its required condition are one object, so a claim whose disclosure is missing cannot be rendered at all.
Data handling
The design question comes before the security question: a field that was never collected cannot leak, be retained too long, or turn up in a log.
Security posture
A description of practices, not a certification, published so it can be inspected and argued with.
Secrets and configuration
A credential committed alongside the code has been distributed to everyone who has ever taken a copy, and deleting the file does not retrieve it.
Input and trust boundaries
Anything arriving from a browser was composed by whoever is sitting there, not by the form that was designed.
Sources and verification
A requirement drafted from general knowledge reads exactly like one drafted from the statute, so the source and the date are stored as fields.
Subprocessors
Every third party a system talks to holds part of what customers hand over; the list is short by design and written down.
What Security & Compliance does not take on.
- Legal advice. We build mechanisms; a qualified professional decides what the wording must say.
- Formal certification or attestation. No claim is made to SOC 2, ISO 27001, HIPAA, or PCI compliance.
- Penetration testing and offensive security engagements.