What is held, where it sits, and who else can see it.
Everything below is a description of practice, not a certification. It is published so that it can be checked.
Where systems run
Client systems are hosted on established cloud platforms in the United States, with the domain and the billing held in the client's own name wherever it is practical. Hosting the firm operates on a client's behalf is named in the engagement rather than left implicit.
Live systems are separated from the environments used to build and test them, with different access and different credentials for each. Access to a running system is granted to individuals, never through a shared login, and is withdrawn on a schedule rather than when somebody remembers.
Sites the firm builds are, wherever the work permits, prepared in advance and served as finished documents. There is no editing panel to sign in to, no database sitting behind a login, and no add-on ecosystem — the surface that arrives as standard with a content management system is not defended, it is absent.
What is collected
The design principle is to hold less. A field that was never collected cannot leak, cannot be kept too long, cannot appear somewhere it should not, and does not have to be described in a policy — so every field on every form is justified by naming what consumes it.
Anything a visitor can type is treated as potentially sensitive, because eventually somebody will put something sensitive in it. Values of that kind are removed from operational records at the point they are written, not filtered afterwards, since a record is copied elsewhere within seconds.
How long anything is kept is a decision with a number attached, and deletion actually happens. A policy describing an intention while records accumulate indefinitely is worse than none, because it has been written down and can be produced later as evidence of what was supposed to occur.
Analytics is chosen on what it collects rather than on what it reports. Nothing used here fingerprints visitors or records their sessions, and aggregate counts answer nearly every question a business actually has.
Who else is involved
Every outside party that touches client data is named, along with what it does and what reaches it. The list is deliberately short, and keeping it short is a design decision rather than a happy accident.
Typically it comprises a hosting platform, a domain and network provider, and a service that sends transactional mail. Where a client's system requires more — a payment processor, a scheduling system, a customer record — those are named in that engagement's own documentation.
Card details never pass through systems the firm builds. They go directly to the client's payment processor, which removes an entire regulatory regime from scope instead of attempting to satisfy it.
Typefaces, icons, and supporting files are served from the site's own infrastructure. Requesting them from somebody else's network would send a record of every visitor to a third party as a side effect of a typographic decision.
Continuity
Backups are verified by restoring them. A backup nobody has restored is a belief, and the moment to establish the difference is not while a business is down.
Recovery time is measured by performing a recovery and then written down, so a client can decide whether it is acceptable while there is still time to change it. An estimate produced from the size of a file is not an answer.
Copies are kept somewhere a compromised credential cannot quietly rewrite, and in more than one place. The scenario that defeats an otherwise sound arrangement is not equipment failure; it is losing the copies along with the original.
What is monitored is what a business would actually notice losing: the domain resolving, certificates valid and not near expiry, the site serving a page, and mail to the published address arriving. Coverage hours are stated in the engagement instead of implied.
What is not claimed
No certification or attestation of any kind. No claim is made to SOC 2, ISO 27001, HIPAA, or PCI compliance, and no audit has been performed against any of the practices described here.
No offensive security testing. Where a genuine adversarial assessment is warranted, it is a separate engagement with a specialist firm, and saying so is part of the work.
None of the above is proportionate to an organization facing determined, targeted adversaries. A business whose risk exceeds it should be told that plainly instead of sold reassurance.
Questions about any of this can go to [email protected], and are answered directly.