How we protect the site and your data

We are a small consultancy, so we keep this page to what our systems actually do. Each point below is checked against the live configuration.

Security headers on every page

Every page and file the site serves carries the headers in the table below.

Spam and bot protection on forms

Every form submission is checked by Google reCAPTCHA and rejected if it fails, and the number of submissions from one address is limited.

Private report links

Each assessment report has its own unguessable link. Report pages tell search engines not to index them, are not stored in shared caches, and do not pass their address to other sites. A report link can be withdrawn, after which it stops working.

Where your data is held

Form submissions are held on Google Cloud in London. They pass from the website to our CRM over an authenticated connection that only our backend can use.

Logs that delete themselves

Server logs, which hold IP addresses and browser details, are deleted automatically after 30 days.

Nothing sensitive asked of you

The site has no visitor accounts or passwords and takes no payments.

The headers we send

Header	Value	What it does
`X-Content-Type-Options`	`nosniff`	Browsers must not guess what a file is, which blocks a class of disguised-file attacks
`X-Frame-Options`	`DENY`	No other site can show our pages inside a frame, which blocks click-jacking
`Content-Security-Policy`	`frame-ancestors 'none'; object-src 'none'; base-uri 'self'`	No other site can frame our pages, browser plugins cannot run, and page links cannot be redirected
`Referrer-Policy`	`strict-origin-when-cross-origin`	Other sites you follow a link to see only our domain, not the page you were on
`Permissions-Policy`	`camera=(), microphone=(), geolocation=()`	Our pages cannot ask for your camera, microphone or location

How we handle your personal data

What we collect, why, and how long we keep it is set out in our Privacy Policy. The cookies and browser storage the site uses are listed in our Cookie Policy.

Reporting a security problem

If you think you have found a security problem with the site, email contact@hailo-ops.com with the details. Please do not test it in ways that could affect other visitors or their data. We reply within 5 working days.