Security & compliance
Protect your website and the information customers share with you. A CISSO-certified owner handles the security setup, access controls, and ongoing care your project needs.
Security that ships by default.
None of the following is an add-on or an upsell. It is how the site arrives, including this one, which sets exactly the headers described below.
Hardened headers by default
Content type sniffing off, framing denied, referrer policy tightened, and camera, microphone and geolocation switched off at the browser. Set on every response, on every build.
HTTPS everywhere
Certificates issued, renewed, and monitored. No mixed content, no expiry surprises on a holiday weekend.
Least data by default
We collect what a form needs to reach you and nothing more. Fewer fields is less to leak.
No third-party tracking
This site runs no analytics and sets no tracking cookies, which is why our privacy policy is short enough to actually read. We will build yours the same way if you want it.
Put AI to work with clear ownership.
When AI is part of a website or connected workflow, agree on the job it should do, the information it can use, and the decisions a person must review. Implementation and governance belong in the same plan.
Define the use and the controls.
Set permitted uses, data access, human review, and a way to report problems before rollout. Test the workflow against the result your business needs.
Know who is responsible.
Document who approves changes, who handles issues, and what ongoing support covers. Your proposal defines the implementation, review, and monitoring included in the engagement.
The half of your identity that isn’t the website.
Your domain and your email are the same asset as your site, and they are where small businesses get hurt most often. Both come with every build, and both are watched on a maintenance plan.
Email at your own domain
you@yourbusiness.com rather than a free address. We handle setup and explain how to use and manage the account.
Email authentication
We configure domain authentication records to help receiving services verify your messages and reduce spoofing. We also check for common delivery problems.
Checked, then watched
We confirm that mail from your domain actually arrives, and keep an eye on it afterwards. Most businesses find out this is broken when a customer mentions they never got the estimate.
The domain in your name
Registered to you, renewals watched, locked against transfer. You keep account access and control of your domain.
When the rules are somebody else's.
Some clients answer to a regulator. We build with those requirements in mind and keep your site aligned as standards move.
HIPAA-conscious builds
For practices handling patient information, we design intake and storage with the requirements in mind and tell you plainly where a website stops and a compliance program starts.
SOX-conscious controls
Change tracking, access discipline, and documented deploys, so an auditor asking who changed what has an answer.
What we will never claim.
We are a web studio with a security-minded owner. We are not your auditor, we do not issue certifications, and we will not tell you that a well-built website makes an organization HIPAA compliant, because it does not. Compliance is a program covering your people and processes, and the site is one part of it. Anyone selling you “compliance” as a website feature is selling you something that does not exist.
The things people usually ask.
And if yours isn’t here, just ask, a real person will answer.
Cesar holds a Certified Information Systems Security Officer (CISSO) credential. Your proposal identifies the work your site needs, such as access controls, secure configuration, backups, and monitoring, along with any ongoing care.
Have a requirement you need to meet?
Tell us what you are being asked for and by whom. We will tell you what a website can do about it, and where you will need help we are not the right people to give.
Prefer to talk it through? Call (956) 477-1721 or email team@acacialakeweb.com. Either way, you’ll hear back within one business day.