Last updated: 19 August 2026
What I do not claim
I am not ISO 27001 certified, not SOC 2 audited, and not “GDPR certified” — that last one does not exist as a certification, and any supplier claiming it is telling you something false. If your procurement process requires a certified supplier, I am not eligible, and I would rather you know that now than three weeks into a process.
This website
- Static HTML with no server-side application code, so there is no database or runtime to compromise
- No cookies, no third-party scripts, no external requests of any kind
- HTTPS enforced, with HSTS
- Content Security Policy,
X-Content-Type-Options,X-Frame-Options,Referrer-PolicyandPermissions-Policyall set - Directory listings disabled; archives, dotfiles and backup extensions blocked at the server
- Contact form protected by a honeypot and a timing check rather than a third-party CAPTCHA, which would break the no-third-party property
Devices and access
- Full-disk encryption on every device used for client work
- A password manager with unique generated credentials for every account
- Two-factor authentication on every account that supports it — email, GitHub, hosting, payment providers
- Automatic screen lock, and operating-system updates applied promptly
- Client credentials stored in the password manager, never in plain text files, notes or chat history
How I write code
- Prepared statements for every database query — no string-concatenated SQL, ever
- Input validation on the server, never trusting client-side checks alone
- Output escaping appropriate to context, to prevent cross-site scripting
- CSRF protection on every state-changing form
- Passwords hashed with a modern algorithm; never stored recoverably
- Secrets in environment variables, never committed to version control
- Dependencies kept current, with known-vulnerability checks before each release
- Least privilege on database users and file permissions
Handling your data during a project
- Access limited to the minimum needed for the task in hand
- Anonymised or synthetic data in development environments wherever the work permits
- Production database copies deleted as soon as the task requiring them is complete
- Client data never stored on removable media or personal cloud storage
- Access credentials returned or revoked at the end of an engagement
Backups
- Automated backups configured for every site I maintain under retainer
- Restores tested quarterly — an untested backup is a guess, not a backup
- Backups stored in your hosting account, under your control, not mine
If something goes wrong
If I become aware of a security incident affecting your data, I will tell you within 24 hours with what I know at that point, and keep you updated as I learn more. I will not delay a notification to finish investigating first. Full terms are in clause 6 of the DPA.
Reporting a vulnerability
If you have found a security issue in this site or in something I built, email anasrajpoot766@gmail.com with the details. I will acknowledge within one business day and keep you updated until it is resolved. I will not take legal action against anyone who reports a genuine issue in good faith and gives me reasonable time to fix it before disclosing it.
What I would ask of you
Security is shared. Use unique passwords on the accounts you own, turn on two-factor authentication, keep the number of people with administrator access small, and tell me when someone with access leaves your business so their account can be removed. Most incidents I have seen in small businesses trace back to a shared password that outlived the person using it.