Safe contact
Use official contact channels. Do not send passwords, authentication codes, bank card details, identity documents or client databases in an initial email or WhatsApp enquiry. If access or personal data is needed, an appropriate channel and the minimum necessary access must be agreed first.
Institutional website
This version uses same-origin resources and has no accounts, payments, collection forms or customer database integration. Hosting uses HTTPS and HTTP security rules to restrict resource execution and embedding by other websites. HTTPS alone does not demonstrate that every business process is secure.
Projects involving personal data
Before processing data on a client’s behalf, written arrangements must define purpose, instructions, authorised people, subprocessors, retention, return or deletion, incident handling and assistance with rights requests. Access must be limited to what is necessary. Testing should use fictional or minimised data wherever possible.
Reporting a problem
Report suspected incidents or exposed data to [email protected]. Include the page, time and a minimal description without sending other people’s data or secrets. This channel does not authorise access to others’ accounts or intrusive testing.
Operational validation
Access controls, multi-factor authentication, backups, supplier contracts and any database require a separate review. No certification, absence of vulnerabilities or guarantee of freedom from incidents is claimed. Future SaaS products require authentication and customer-isolation testing before launch.