Security
How this website protects itself.
Every value below was read from a live response on this domain on 3 November 2026, not copied from a specification. If a control is not in place, it is not claimed here.
How we protect client material sits on the privacy notice, and how to report a finding is at the foot of this page.
Legal identity
NextZen Security LLC.
Response headers, read from the live site
Every response this site sends carries the following headers.
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-src https://calendly.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| Cross-Origin-Opener-Policy | same-origin |
The application asks for a longer HSTS lifetime with the preload directive. The delivery network in front of this site serves the shorter value shown above, and the domain has not been submitted to the browser preload list. Those two facts are stated rather than glossed over.
What those headers stop
- Another website embedding these pages in a frame, which is how most clickjacking attacks work.
- Scripts, styles, images or connections arriving from anywhere other than this site and the two font hosts named above.
- Browser plugins running content inside these pages.
- This form sending your message to any address other than this site.
- Camera, microphone, location and payment access on every page, whether or not a feature asks for it.
The booking calendar is the one frame this site allows, from calendly.com. Nothing else can frame or be framed here.
Client evidence
Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope.
Client evidence is never used to train any model.
Insurance
Professional indemnity and cyber liability insurance is held. Certificates of currency are provided to clients under NDA. Limits are not published.
Report a vulnerability
Report a weakness in this website using the contact in our security.txt. We acknowledge reports within three business days.
Safe harbour. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure.
Out of scope: denial of service, social engineering, physical attacks and third-party services.