Protect the information people trust us with
We treat privacy and account security as product requirements, not as text added after a launch. We avoid asking visitors to share passwords, one-time codes, recovery codes, payment card details, or private keys through public contact routes.
Use the right boundary for the action
Public company information does not require an account. When a separate product handles accounts, private records, or privileged actions, those operations need appropriate identity checks, permission enforcement, validation, and monitoring at the service that controls the data. A check performed only in the visitor's browser is not sufficient to protect a private operation.
Keep credentials and private records out of public materials
We do not publish customer records, credentials, signing keys, access tokens, or secret configuration in public pages or public documentation. We use company-controlled accounts and limit privileged access. If a credential may have been exposed, we revoke or rotate it rather than relying on removing the visible text alone.
Review and recover safely
We review important changes before publication, keep a known-good recovery point, and inspect hosting results after a release. A successful upload alone is not evidence that the live experience is correct.
Report a concern responsibly
If you find a suspected vulnerability or unintended disclosure, contact our team with the affected public URL, the observed behaviour, and safe reproduction steps. Do not access another person's account or data, and do not publish sensitive information while reporting the issue.
Our privacy and terms pages remain drafts until we complete a review against the actual practices of our company and products.