Security & compliance
Our owner holds a CISSO certification, which is a background in holding systems to a standard rather than a decoration. It shapes how every site here gets built, from the first line through the day-to-day care afterward.
Our owner holds a CISSO certification, which is a background in holding systems to a standard rather than a decoration. It shapes how every site here gets built, from the first line through the day-to-day care afterward.
None of the following is an add-on or an upsell. It is how the site arrives, including this one, which sets exactly the headers described below.
Content type sniffing off, framing denied, referrer policy tightened, and camera, microphone and geolocation switched off at the browser. Set on every response, on every build.
Certificates issued, renewed, and monitored. No mixed content, no expiry surprises on a holiday weekend.
We collect what a form needs to reach you and nothing more. Fewer fields is less to leak.
This site runs no analytics and sets no tracking cookies, which is why our privacy policy is short enough to actually read. We will build yours the same way if you want it.
Some clients answer to a regulator. We build with those requirements in mind and keep your site aligned as standards move.
For practices handling patient information, we design intake and storage with the requirements in mind and tell you plainly where a website stops and a compliance program starts.
Change tracking, access discipline, and documented deploys, so an auditor asking who changed what has an answer.
We are a web studio with a security-minded owner. We are not your auditor, we do not issue certifications, and we will not tell you that a well-built website makes an organization HIPAA compliant, because it does not. Compliance is a program covering your people and processes, and the site is one part of it. Anyone selling you “compliance” as a website feature is selling you something that does not exist.
Tell us what you are being asked for and by whom. We will tell you what a website can genuinely do about it, and where you will need help we are not the right people to give.