Trust
How this website is secured
It would be strange to sell security and be vague about our own front door. This page describes the controls on this site, and — more usefully — where they stop.
What is in place
Content Security Policy
The browser is told exactly which domains may supply scripts, styles, images and frames. Anything else is blocked, which limits the damage a code-injection flaw could do.
Transport security
HTTPS only, with HSTS instructing browsers never to attempt an unencrypted connection to this domain again.
No third-party trackers
No advertising pixels, no session recording, no heatmaps, no social widgets. Fonts are served from our own domain rather than Google's, so nobody outside CY6 learns who reads this site.
Input validation
The contact form is the only route that accepts input. Every submission is validated against a strict schema on the server, regardless of what the browser checked first.
Rate limiting and spam resistance
Repeated submissions from the same source are throttled. Automated submissions are filtered with a hidden field and timing checks rather than by making you solve a puzzle.
Restrained logging
We log that a submission happened and enough to debug a failure. We do not log message contents, and IP addresses are hashed rather than stored.
Least privilege integration
The website holds no CRM API key. It can only post an enquiry to a write-only webhook, so a compromise of the site cannot read anything out of the CRM.
Static by default
Nearly every page is pre-built at deploy time and served as a file. Less code running per request means less surface to attack.
Limits
What this does not cover
Being specific about limits is the part most vendors skip. It is also the part that tells you whether the rest was honest.
- This site is not, and cannot be, 'completely secure'. Anyone who tells you otherwise about any system is selling something.
- Rate limiting is held in server memory. It raises the cost of casual abuse but is not a defence against a distributed flood; Cloudflare in front of it does that work.
- The Content Security Policy still permits inline scripts, which the framework currently requires. Moving to a nonce-based policy is on the roadmap and is documented in the repository.
- Enquiry data is handled by HighLevel and Google Workspace once it leaves this site. Their security is theirs, and is covered by their agreements rather than ours.
- The site has not been penetration-tested by an independent third party. When it is, we will say so here and say who did it.
Responsible disclosure
If you believe you have found a security issue in this website, please tell us before you tell anyone else. Email [email protected] with enough detail to reproduce it. We will acknowledge within two business days, keep you updated, and credit you publicly if you would like us to. We will not pursue legal action against good-faith research that avoids privacy violations, service disruption and data destruction.
Want this level of clarity about your own systems?
That is the whole job. We document what is in place, what is not, and what it would take to close the difference.
Or call 1-855-966-2967