Security practices for client work

Static files only. No server code, no database, no user accounts, no data-collection forms: the search box on this site never submits anywhere, and the Content-Security-Policy blocks form submission outright.

Content Security Policy with no inline scripts. Every inline block is hashed at build time.

No cookies, no consent banner, no cross-site tracking. Analytics are aggregate and cookieless.

Full-disk encryption on the machine I work from, with an automatic screen lock.

Two-factor authentication on every work account, and passwords in a password manager rather than in a file or a browser.

Nothing client-owned is used to train or improve a model.

I ask for a named account in your own systems, scoped to the work, so you hold the off-switch and revoke it at handover.

The work happens inside your systems. I keep no copy of your documents, exports, tickets or logs.

My own working notes are deleted at handover, and the handover lists every credential I held so revoking them is a checklist rather than a memory.

If I find that your material has been exposed, I tell you within 24 hours of finding out.

You get what I know at that point, not a polished version of it a week later.

Anything further, including who else must be notified, is set in your contract rather than on this page.