Security
Last updated: 2026-02-19
Our Security Approach
Security is not an afterthought — it is the foundation of everything we build. As a cybersecurity professional with 12+ years of experience in application security, penetration testing, and security architecture, I apply the same standards to my own infrastructure that I recommend to clients.
This page documents the technical and organizational measures we implement to protect your data.
Secure Development Lifecycle
This website is developed following secure development practices at every stage. As a recognized conference speaker on Secure SDLC and DevSecOps (with talks at DUMP, Payment Security, CodeFest, and other conferences), and author of a DevSecOps course, I ensure these practices are actively implemented — not just theoretical.
| Phase | Practice | Detail |
|---|---|---|
| Requirements | Security requirements gathering | Privacy by design requirements defined before development (GDPR Article 25) |
| Design | Threat modeling | Architecture reviewed against OWASP Top 10, serverless-specific threats, and data flow analysis |
| Development | Secure coding | Server-side input validation, output encoding, parameterized database queries |
| Development | Dependency management | Minimal dependency footprint — zero npm runtime dependencies in Worker |
| Development | Code review | All code reviewed before deployment |
| Testing | Security testing | Anti-bot bypass testing, rate limit validation, CORS verification, input fuzzing |
| Testing | Source analysis | Source code analyzed for injection patterns, unsafe functions, secret leakage |
| Deployment | Immutable deployments | Each deploy is an atomic snapshot — no in-place modifications |
| Deployment | Configuration security | Secrets stored in encrypted environment, never in code or version control |
| Operations | Security headers | Configured via infrastructure provider (Cloudflare) — attack surface for header manipulation is minimal in serverless architecture |
| Operations | Monitoring | Cloudflare Dashboard analytics (traffic patterns, error rates, threat intelligence), Umami analytics (visitor anomalies), Telegram real-time alerts on every form submission |
| Maintenance | Vulnerability response | security.txt published, dedicated security report form |
Architecture & Attack Surface
We employ a serverless architecture that eliminates traditional server-side attack vectors.
- No servers — static site on Cloudflare Pages, backend on Cloudflare Workers
- No SSH/RDP — no remote access to servers (there are none)
- No OS-level patching — no operating system to maintain or patch
- Stateless edge compute — Workers are stateless, data stored only in D1
- Immutable deployments — each deploy is a new snapshot
Infrastructure Partner Certifications
Core infrastructure is delegated to Cloudflare, Inc., a provider with extensive security certifications. This minimizes our attack surface while leveraging enterprise-grade security controls.
| Certification | Description |
|---|---|
| ISO 27001:2022 | Information Security Management System |
| ISO 27701:2019 | Privacy Information Management (PIMS) |
| ISO 27018:2019 | PII protection in public clouds |
| SOC 2 Type II | Security, Confidentiality, Availability audit |
| PCI DSS Level 1 | Payment card data protection (highest tier) |
| C5:2020 (BSI) | German Cloud Computing Compliance Criteria |
| EU-US Data Privacy Framework | Legal mechanism for US data transfers |
| EU Cloud Code of Conduct | European cloud security principles |
Cloudflare's Data Processing Addendum (DPA) applies to all accounts and covers EU Standard Contractual Clauses. D1 database operates with EU jurisdiction — data physically resides in the European Union.
Technical Measures
We implement defense-in-depth measures proportionate to the data we process.
| Layer | Measure | Detail |
|---|---|---|
| Transport | TLS 1.3 | All connections encrypted, HSTS enabled |
| Storage | IP hashing | SHA-256 with unique salt, non-reversible |
| Anti-bot | HMAC tokens | Single-use, time-limited form tokens |
| Rate limiting | Per-IP hash | Adaptive rate limits configured per endpoint and globally, calibrated for security and business requirements |
| Input validation | Server-side | Strict sanitization, length limits, type checks |
| Honeypot | Hidden field | Silent spam detection |
| Headers | Security headers | Managed by Cloudflare infrastructure — X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. Serverless architecture eliminates risks of misconfigured application servers. |
| Analytics | Privacy-first | No cookies, no PII, fully anonymized |
| Data residency | EU jurisdiction | Cloudflare D1 with EU data location |
Organizational Measures
Access to personal data and infrastructure is strictly limited.
- Single operator — only the site owner has access to Cloudflare Dashboard, D1 database, and Worker secrets
- Multi-factor authentication (MFA) enabled on all infrastructure accounts
- No shared credentials — all secrets stored in Cloudflare encrypted environment
- No third-party access to infrastructure
- Private version control — source code in private Git repository
- Zero standing access — no persistent connections to data stores
Compliance Alignment
Our security practices are aligned with ISO 27001 control objectives. We have not pursued formal certification but maintain documented implementation of applicable controls.
| Domain | Name | Status |
|---|---|---|
| A.5 | Information security policies | Documented security approach (this page) |
| A.6 | Organization of information security | Single operator, clear responsibilities |
| A.8 | Asset management | Inventory of data assets maintained (ROPA) |
| A.9 | Access control | MFA, single operator, no shared credentials |
| A.10 | Cryptography | TLS 1.3, SHA-256 hashing with salt |
| A.12 | Operations security | Immutable deployments, monitoring |
| A.13 | Communications security | All transit encrypted, CORS, origin validation |
| A.14 | System development | Secure SDLC practices (see above) |
| A.16 | Incident management | Documented incident response plan maintained |
| A.17 | Business continuity | Documented business continuity plan maintained |
| A.18 | Compliance | GDPR compliance documented, ROPA maintained |
We also maintain documented Incident Response and Business Continuity plans. Records of Processing Activities (ROPA) are maintained in accordance with GDPR Article 30.
Incident Response
We maintain a documented incident response procedure aligned with GDPR Articles 33-34. The plan covers detection, containment, assessment, notification (supervisory authority within 72 hours, data subjects when required), remediation, and post-incident review.
Responsible Disclosure
We welcome security reports from researchers and the public.
- security.txt — Machine-readable security contact file (RFC 9116)
- PGP Key — Encrypt your report for confidential submission
- Report Form — Submit a security report directly through our website
Report a Security Issue
If you've found a vulnerability or security concern related to this website, please let us know. We take all reports seriously and will respond within 5 business days.