Trust Centre
Security engineered into our work, and our website.
Legal identity
NextZen Security LLC.
Security headers
Every response from this site carries the following headers.
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-src https://calendly.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| Cross-Origin-Opener-Policy | same-origin |
Independent scan results
Results from securityheaders.com, Mozilla Observatory and Lighthouse are published here with the scan date once the site is live on its domain.
Vulnerability disclosure
Report vulnerabilities in this website using the contact in our security.txt. We acknowledge reports within three business days.
Safe harbour. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure.
Out of scope: denial of service, social engineering, physical attacks and third-party services.
Client evidence
Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope.
Client evidence is never used to train any model.
Insurance
Professional indemnity and cyber liability insurance is held. Certificates of currency are provided to clients under NDA. Limits are not published.