Security
How we keep things safe.
What this website does to protect you, how we handle what you send us, and how to report a problem.
This website
- Every page is served over HTTPS, with HTTP Strict Transport Security.
- A Content Security Policy limits which scripts, frames and connections a page may use.
- The microphone is allowed for this site only, and only after you click and your browser asks. The camera is not used.
- Forms are protected by Cloudflare Turnstile, a hidden honeypot field and rate limits.
- Rate limits use a short-lived, one-way hash. We do not store IP addresses.
- The admin area is not reachable on the public site.
Data you send us
- Enquiries we store are kept in a database with row-level security and no public access. Only our server can read or write them.
- API keys and secrets stay on the server and never reach your browser.
- Conversations with the concierge are not kept unless you choose to send them to us.