Security
Security, stated plainly.
This site is a static frontend. That is, by itself, a strong security starting point — and a limit on what can be claimed.
What is in place today
Transport & headers
HTTPS via Cloudflare, plus security headers: nosniff, strict referrer, Permissions-Policy (camera/mic self only, geolocation/payment blocked), X-Frame-Options DENY.
No secrets in the repo
No API keys, tokens, passwords, or App Secrets are in the code or the repo. A future Realtime App Secret must stay on a trusted backend only, never in browser code.
No data collected by this preview
No backend, analytics, or form submission service is connected to this static preview, so no customer data is collected by it. Demo signup stores only a display name in your own browser session.
What is NOT claimed
No SOC 2, ISO, GDPR, or HIPAA certification is claimed. No penetration test, audit, or compliance review has been published. Those will be claimed only when they actually exist, with the report or certificate linked. For a security question, use the contact page.
Status: Planned unless this page says otherwise. No customers, certifications, integrations, or prices are claimed here.