Security
Your site, kept safe.
The short version: I keep your website and your customers' information safe, back everything up daily, and if anything ever goes wrong, you'll hear from me quickly.
Your site and your customers' information are kept safe
Every page is secure (the padlock in the browser), the software is updated every month, and only the access that's actually needed is ever set up.
Everything is backed up daily
If anything ever breaks, it's restored. You won't lose your site.
If anything goes wrong, you'll hear from me quickly
If there's ever a security problem that affects your site, I'll tell you what happened, what I did about it, and what changes so it doesn't happen again.
About this website
This site (mosaicridge.com) is simple: a set of pages and one contact form. It doesn't store customer data, has no user accounts, and takes no payments. Messages you send through the form come straight to my inbox.
Questions about security? Call, text, or email me. See also the accessibility statement.
For the technical folks
The details your web developer or IT person might ask about. You don't need any of this to work with me.
Hosting and services
- Application hosting
- Vercel: US-based regions, SOC 2 Type 2 attested.
- Resend: TLS-enforced delivery, DKIM and SPF on outbound mail.
- Database (only where a site stores data)
- Supabase managed Postgres: SOC 2 Type 2 attested, encrypted at rest, with row-level security.
- Payments (online stores only)
- Stripe: PCI DSS Level 1. Card data is never stored on the site.
Each site uses only the services its plan needs, and no others.
Controls
- TLS 1.2+ on every public endpoint, HSTS and HTTP/2 on every production deployment
- Content Security Policy headers, with the allowlist set per project
- Role-based access on any admin area; httpOnly, Secure, SameSite session cookies; PKCE for any third-party sign-in
- Least-privilege credentials, never a shared or long-lived admin key
- Production workloads in US-based regions; data encrypted at rest by the database provider
- OWASP Top 10 awareness in the build; automated dependency scanning (Dependabot) and npm audit on every dependency change
- Every deployment must pass lint, type-check, tests, and build
- Security incidents disclosed to affected clients within 72 hours of confirmation, with a written root-cause and prevention report
Next step
What can I help with?
Start with a free website & Google checkup. I'll look at your site and Google profile and tell you, in plain English, what's working and what isn't. No charge, no pressure.
Get a free checkup