Security

1. Connection and browser protection

The website is served over HTTPS only, with security headers that make common browser attacks harder:

• HSTS — browsers connect over encrypted connections only
• Content Security Policy — only approved script sources
• Protection against framing (clickjacking) and MIME sniffing
• Restrictive referrer and permissions policies

2. Sign-in and forms

• Passwordless sign-in via email link — no passwords are stored
• Sessions in signed, server-only cookies
• Origin checks (CSRF protection) on forms and APIs
• Rate limiting and spam protection on the contact form
• Server-side validation of every input's type and length

3. Data

• Client access keys are stored encrypted (AES-256-GCM)
• Online payments are disabled; this website does not collect card or bank account details.
• We collect only the data needed for the enquiry, contract and billing (see the privacy policy)

4. Client projects

We set up websites, automations and accounts on your own accounts. We ask for separate access for our team instead of shared passwords and recommend revoking it after handover. You receive all code, access and documentation.

5. Reporting a vulnerability

If you find a potential vulnerability, please email info@onravetoni.com with a short description and steps to reproduce. We acknowledge within three working days, fix confirmed issues as quickly as possible and keep you informed. Please do not access other people's data or disrupt the service.