How this site protects data.
This site sets no cookies, runs no analytics, and serves every request over HTTPS. The only data it stores comes from the assistant, in a database with no public access. Report a vulnerability to info@corsacvantage.com with Security in the subject line.
What is in place
Encrypted in transit. Every page and request is served over HTTPS, and browsers are told to refuse plain connections to this domain.
No public database access. Assistant conversations and contact details are stored in a database with no public access. Only the site's server code can read or write them, and the provider encrypts the data at rest.
Secrets stay on the server. API keys live in the hosting provider's encrypted environment settings and never reach a browser.
IP addresses are hashed. The assistant stores a salted one-way hash of your IP address, used only for rate limits, and never the address itself.
Rate limits. The assistant limits sessions and messages per visitor and across the whole site.
Nothing third party in the page. No analytics, tag managers, advertising scripts, or font networks. Fonts and video are served from this domain.
Reporting a vulnerability
Email info@corsacvantage.com with Security in the subject line. Include the page or endpoint, the steps to reproduce, and what you observed.
Please do not access data that is not yours, degrade the service for other visitors, or publish details before the issue is fixed. The firm will acknowledge the report and keep you informed. There is no bug bounty.
The same contact details are published in machine-readable form at /.well-known/security.txt.
Client work
Security requirements for a client build are set at scoping and written into the engagement agreement. Every agent ships with tiered authority, escalation paths, and an audit trail.