TRUST & SECURITY
What we can put in writing.
Our own posture, how we handle access and data, who processes what, and what we do when something breaks. Every item can be checked or requested.
Our own posture
We run the controls we ask you to run.
This site is static, so the list is short by design. Short is not the same as verified — check it yourself before you take our word for it.
- TLS 1.3 with HSTS on all HTTPS responses
- Strong security headers: CSP, HSTS, frame options, referrer policy and permissions policy
- MFA on every account that can change this site or reach client data
- Least-privilege access for every account, including ours
- Weekly backups, with a restore tested on the same schedule
- Dependency updates on a fixed schedule, with changelogs read before merging
Verify it yourself
Check us with Security Headers and SSL Labs before you trust anything on this page.
Both are free and independent of us. If something fails, tell us — we would rather fix it than have it found in your procurement review.
Checks and evidence
- Security Headers — CSP, HSTS, frame options and referrer policy on the apex domain
- SSL Labs — protocol version, cipher suites and certificate chain
Access
Access is scoped, time-boxed and removed.
The real question is not whether a vendor can be trusted. It is what the vendor can reach, for how long, and what evidence is left when they leave.
Ask about a specific access request- A dedicated vault per engagement. Credentials live in one vault, shared only with the people on that engagement and removed when it closes.
- MFA required. Every account we use, including client-owned admin panels, needs a second factor. Convenience is not an exception.
- Time-boxed and revoked within 30 days. Access is granted for the engagement window and removed within 30 days of close, with written confirmation on request.
- No credentials over email. Not before the contract, not during delivery, not after. We use the vault or a scoped invite.
- Production only when the scope requires it. Staging, a copy or read-only access is the default; production admin needs a written reason.
Data handling
How long we keep things.
These periods apply to this site and to client engagements unless a signed contract sets a different one. Deletion is confirmed in writing, every time.
| Data | Where it lives | Retention | Deletion |
|---|---|---|---|
| Contact form submissions | Form database and shared inbox | 24 months from the last reply | Deleted on written request; confirmation sent in writing |
| Engagement notes | Private project workspace, engagement team only | 12 months after project close | Destroyed at close on request; written confirmation |
| Findings and reports | Encrypted storage and your own copy | 12 months; your copy is yours to keep | Our copy deleted on request; written confirmation |
| Logs and raw scan output | Hosting, access and scan workspace logs | 30 days, then rotated or deleted | Deletion confirmed in writing with the close-out |
Deletion requests go to xcsfx@icloud.com. We confirm what was deleted, from where and on what date.
Subprocessors
Who touches the data, and what they see.
Five categories. None of them receive more than the job requires.
| Service | Purpose | Data category |
|---|---|---|
| Edge network and WAF | TLS termination, caching and request filtering | IP address, request headers and security events |
| Static hosting | Serves this site's pages, styles and scripts | IP address and standard request logs |
| Receives form submissions and carries replies | Name, email address and message content | |
| Payments | Charges care plans and project invoices | Billing contact and invoice total; card details stay with the processor |
| Uptime monitoring | Checks that the site and its endpoints respond | Request path, status code and response time |
This table is a summary. The DPA carries the authoritative list for a signed engagement, including legal entities, processing terms and breach notification.
Incident response
The first five days, in writing.
These times assume support hours, 09:00–18:00 GMT+8, Monday to Friday. They are commitments we can keep, not an aspiration.
Acknowledge within 4 business hours
A named person confirms the report, the affected scope and the next update time.
Update every 24 hours
A written update each day until the incident is closed, even when there is nothing new to say.
Root cause within 5 business days
What happened, in order, and which control failed or was missing.
Post-mortem for the client
The same root cause, plus what changed, written so your team can act on it.
We are not a 24/7 SOC. There is no overnight rota and no 3 a.m. promise. If your requirement is round-the-clock on-call, this is not a fit, and we will say so on the first call rather than in a proposal.
Certifications
We do not hold ISO 27001 or SOC 2.
We will not claim a certification we do not have, and we will not borrow credibility from a logo we are not entitled to display.
What we cannot give you
- ISO 27001 certification
- SOC 2 Type I or Type II report
- Cyber Essentials certification
- PCI DSS attestation — card data stays with the payment processor
If your procurement requires one of these, we are not the vendor for that deal. We would rather lose it than misrepresent the paperwork.
Evidence you can read
- Written security policies, versioned and shared on request
- Least-privilege access with a named owner for every account
- A signed DPA before any client data arrives
- Security questionnaires answered in writing, not on a sales call
- An evidence pack with each engagement: scope, findings, retest, close-out
The answers come from the same policies every time, so they match across deals.
Report a vulnerability
If you think you found something, tell us first.
We would rather read a messy email from a researcher than learn about a flaw somewhere else.
xcsfx@icloud.comSafe harbor
- Good-faith research on your own accounts, or on a test tenant you ask us to create, is welcome.
- Do not access, change or exfiltrate other people's data. Stop and report.
- Give us time to fix it before you publish, and tell us if you plan to publish at all.
- We acknowledge within 2 business days and tell you whether we can reproduce it.
We will not pursue legal action for research that follows these rules. That is the whole policy; there is no separate form.
Next step
Read the document, then ask us the hard question.
The DPA carries the authoritative list of subprocessors and terms. If something here does not match your questionnaire, put it in the form and we will answer in writing.