العربية

Trust & Security

This page sets out the measures we apply to protect this website and its visitors’ data, and the standards we apply to every system we develop for our clients.

Security

  • All connections are encrypted with HTTPS, with HSTS enabled to prevent unencrypted connections.
  • A strict Content Security Policy that permits only approved code, with a unique token for each request.
  • The website cannot be embedded in other sites, and resources are isolated from external origins.
  • The contact form is protected by a signed token, rate limiting, automated-message checks and full server-side validation.

Privacy

  • The website uses no cookies, trackers or targeted advertising.
  • Fonts, images and code are all hosted on our own servers, so the browser makes no requests to third parties.
  • IP addresses are never stored in their original form, only as a keyed hash used solely to prevent abuse.
  • We collect only the data visitors submit themselves, and we never sell it or share it for marketing purposes.

Operational continuity

  • Each system is deployed and runs fully independently, so a fault in one system does not affect the others.
  • Every update is tested before release, with a careful review of the changes.
  • Regular backups and continuous monitoring.

Responsible disclosure

  • If you discover a security vulnerability on this website, please email security@craftedall.com with the steps to reproduce it.
  • We value responsible disclosure, and we are committed to responding to and remediating reports as quickly as possible.
  • Our security contact details are also published in the standard security.txt file.