What we do, checked.
We checked this in our code, which is private: we can show you in a review. It does not replace an external audit.
Practices checked in the code
Session in an HttpOnly cookie
Page code cannot read it. It lasts 24 hours.
Passwords with bcrypt
We store the hash, never the password.
Database with no public port
Reachable only from an internal container network.
The application cannot change the schema
Its role only reads and writes data; migrations use another.
Encrypted daily backups
AES-256, 14-day rotation and a procedure to restore them in isolation.
Security headers
No third-party framing, no type sniffing and limited browser permissions.
Forms with anti-spam and limits
Per-connection limit; the receipt text is erased once it reaches the CRM.
Measurement only with consent
Unless you accept, Google analytics does not load.
Checked in the repository on 2 November 2026.
Security questionnaire
If you need it to decide, ask us before signing and we will answer it point by point.