Security headers configured
CSP, HSTS and the rest set correctly by default, not left at whatever a framework ships with.
SECURITY · MEASURES, NOT GUARANTEES
How we secure systems
No completely secure system exists, and we will not tell you one of ours is. What follows is what we actually do, published as measures rather than a guarantee nobody could honestly make.
ON EVERY BUILD
Three measures, not three upgrades
These cost us nothing extra to include because they are how we build anyway, regardless of budget.
Encryption in transit and at rest
Data is not readable in the gaps between the places it is supposed to be protected.
No third-party script on the render path
Fewer scripts you did not write means fewer ways in you did not choose.
SIGN-IN, ENCRYPTION, INSIDE THE SYSTEM
Three more layers of enterprise cybersecurity
Post-quantum encryption, sign-in protection and monitoring inside systems. Each is a measure we build, not a promise that nothing gets through.
Encryption made for the quantum era
Post-quantum encryption is designed to hold against attacks by quantum computers, for data that has to stay private for years after it is sent.
Post-quantum encryptionA known password alone does not let anyone in
Two-factor sign-in, and sign-in bound to the owner’s device. A guard on the user’s computer watches network routes and cuts a remote session that was not allowed.
Sign-in protectionWatched from inside, while it runs
Monitoring inside the system, in real time: what runs inside it is watched while it runs, not only checked at the door.
Monitoring inside systemsFRAMEWORK MATURITY
NIST CSF: currently Tier 3, working toward Tier 4
The NIST Cybersecurity Framework's four implementation tiers, and where we sit today.
The NIST Cybersecurity Framework is a set of guidelines for how systematically an organisation manages security risk, scored across four tiers from Partial to Adaptive. It does not certify anyone, it gives a shared vocabulary for how consistent a security practice actually is.
| Tier | Name | Where we stand |
|---|---|---|
| Tier 1 | Partial | Passed |
| Tier 2 | Risk Informed | Passed |
| Tier 3 | Repeatable | Current |
| Tier 4 | Adaptive | Target |
Uptime Institute Tier III is a datacentre redundancy standard. NIST CSF Tier 3 is security practice maturity. They share a number and nothing else — always state which framework you mean.
WHAT WE WILL NOT DO
We do not harden systems we did not build
Rule five of the practice standard, applied specifically to security work.
Hardening a weak foundation is fitting an armoured door to a clay house. We rebuild instead, and everything we build carries the measures above by default rather than bolted on afterward.
STRAIGHT ANSWERS
Questions about how we secure systems
The ones that come up before anyone signs anything.
No, and we will not tell you it is. No completely secure system exists, and anyone who claims otherwise is selling you something. What we publish instead is the specific measures every build carries: security headers, encryption in transit and at rest, and no third-party script on the render path. Measures, not guarantees.
NIST Cybersecurity Framework Tier 3, Repeatable, is where formal policies exist and are consistently applied across the organisation, not just followed ad hoc. That is our current tier, and we are working toward Tier 4, Adaptive. It measures security practice maturity, a different thing entirely from Uptime Institute's Tier III, a datacentre redundancy standard that happens to share the same number.
No. Hardening a system built on a weak foundation is fitting an armoured door to a clay house. If your current site has real security gaps, the honest fix is usually a rebuild, not a patch, and we will say so rather than sell you door fitting on a house we did not build.
Two-factor sign-in, and sign-in bound to the owner’s device, so a known password alone does not let anyone in. On the user’s computer, a guard watches network routes and cuts any remote session that was not allowed. Inside the system, monitoring watches what runs in real time. These are measures, not a guarantee.
Nobody gets standing access by default, including us. Access is granted for what a task requires and expires when the task ends, rather than employees or systems carrying broad permissions indefinitely. It is one of the engineering principles behind every system we build, alongside minimum human input and digital hygiene.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.