Last updated: September 8, 2026
Less sensitive data, by design
We ask for business information needed to discuss scope and arrange service. We do not request passwords, recovery codes, patient records or confidential incident evidence in website forms.
Payments stay with PayPal
PayPal handles payment authorization on its own website. Subscription references and status are verified on the server. API secrets are kept out of the browser. A redirect alone does not activate a subscription.
Protecting the website
The application uses server-side validation, prepared database statements, request-origin checks, persistent rate limits and bot-trap fields. Checkout sessions use short-lived HTTP-only cookies with Secure transport on HTTPS. Security headers restrict scripts and resources.
Authorization comes first
Assessment and testing start only after written scope and authorization. Recommendations and changes are distinct activities; implementation requires explicit agreement.
Reporting a potential issue
Use the contact form with “Website security report” in the description. Include affected URLs and a general account of the issue. Ask for a secure channel before sharing sensitive evidence. Do not access other people’s information or disrupt service. This is not an invitation to test without authorization.
A measured commitment
These safeguards do not make any website immune to attack. Configuration and dependencies need continued maintenance. This page is not a security certification or compliance attestation.
Questions or requests
For service, billing, privacy or website security questions, use our contact form. Never include passwords, recovery codes or confidential incident evidence. Ask for a secure channel first.