Security & privacy
Protecting applicant data and DSC access
A secure website is only one part of a secure certificate journey. People, devices and processes matter too.
Website controls included in this build
- Strict Cloudflare-compatible security headers and Content Security Policy.
- No payment collection, password storage or sensitive document upload in the static site.
- Minimal enquiry fields, browser-side validation and explicit contact consent.
- No third-party trackers until a valid Analytics ID is configured.
- External links use safe rel attributes where applicable.
Operational controls to follow
- Never request or store a customer’s token PIN, private key or OTP.
- Use role-based access for mail, Cloudflare, domain and analytics accounts with MFA.
- Keep applicant documents only for the required period, then delete them securely.
- Verify any Google Apps Script endpoint server-side and apply rate limiting before enabling it.
- Publish a breach response contact and revoke compromised credentials immediately.
No site can honestly guarantee it “cannot be hacked.” This build reduces exposure by remaining static and collecting minimal data; secure account configuration and ongoing patching are still required.
