Security Overview

This page describes the controls that apply to this website, the forms on it, and the way we work inside platforms our clients own. It is a description of current practice, not a certification and not a contractual commitment. Where an engagement requires specific security terms, those terms go in the engagement document.

• All traffic is served over HTTPS with TLS, and HTTP requests are redirected.
• Response headers restrict framing, block content-type sniffing, limit referrer data, and constrain which origins can load scripts.
• Form endpoints validate and length-limit every field, reject unexpected content, and apply rate limiting to slow automated submissions.
• Error messages returned to the browser are generic. Diagnostic detail stays server-side.
• Dependencies are updated regularly and the site is rebuilt on each change, so patched versions ship with the next deploy.

• We collect the minimum a form needs. There is no field on this site for financial account numbers, government identifiers or health information.
• Data submitted through forms is stored in a managed database with row-level access rules, so a record is reachable only through an explicitly permitted path.
• Credentials and API keys live in server-side secret storage. They are not present in front-end code and are not logged.
• Retention periods are fixed and published in the privacy notice. Data is deleted when its period ends.

Administrative areas require authentication, and privileged operations run server-side, never in the browser. Access to production data is limited to the people who need it for delivery, on devices with full-disk encryption and screen locks, using unique credentials and multi-factor authentication where the provider supports it.

• We request the narrowest permission set that lets the work proceed, and we ask for elevation only when a task requires it.
• We use named individual accounts in client systems. We do not use shared logins and we do not ask for a password over email or chat.
• Before a migration or a configuration change, the current state is captured so the change can be reversed.
• Client data stays in the client's platforms wherever the work allows it. Where an export is required, it is limited to what the task needs and removed when the task is done.
• Access is revoked at the end of the engagement, and immediately on request at any time.

On learning of a suspected incident we contain it, determine what data was involved, and notify affected clients and individuals. Where a breach of security safeguards creates a real risk of significant harm, we report to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. Where the GDPR applies, notification to the competent supervisory authority is made within 72 hours of awareness. Notification describes what happened, what data was involved, and what we did about it.

If you believe you have found a vulnerability in this website, send it to shannon@thecwtstudio.com with steps to reproduce. We acknowledge reports within five business days and will tell you what we intend to do.

When you report in good faith, we ask that you:

• Give us reasonable time to remediate before publishing anything.
• Avoid privacy violations, data destruction, and degradation of the service.
• Use only your own test data, and stop as soon as you have confirmed the issue. Do not extract more.
• Do not run automated scanning at a volume that affects availability.

We do not run a paid bounty programme. We will not pursue action against a researcher who follows the practices above and reports promptly.

We hold no third-party security certification and we do not claim compliance with a certified audit standard. We do not claim that this site or any system is free of vulnerabilities, and we do not promise that a breach cannot occur. Where a client requires certified controls, that requirement belongs with the platform vendors who host the data, and we will say so.

Security questions, access reviews and due diligence requests go to shannon@thecwtstudio.com. Related reading: the subprocessors page and the privacy notice.