LegalSecurity
How this site is protected.
No big words and no certificates we don't have: below are the measures that actually run in this site's code.
Measures
What is in place.
Each measure in one sentence. What isn't listed isn't promised.
HTTPS everywhere
Every connection is encrypted, and the HSTS header (two years, with the preload flag) tells the browser to open the site over HTTPS only.
Security headers
A Content Security Policy (CSP) limits where scripts and images may load from; on top of that, protection against framing by other sites and against file-type sniffing.
Hashed passwords
Passwords are stored only as an Argon2id hash, never in readable form, and must be at least 12 characters long.
Two-factor sign-in
Every admin account must enter a code from an authenticator app in addition to the password; after too many failed attempts, sign-in is temporarily locked.
Protected forms
The enquiry, booking and contact forms have a bot trap and a limit on submissions from the same network address; the server validates every input before saving it.
Payments via Stripe
Card payments happen on Stripe's payment page, so card details never reach this site; a payment is confirmed only by a signed message from Stripe.
Only necessary data, with a limit
Automatic deletion every night: assistant conversations after 30 days, detailed visit statistics after 6 months, contact form enquiries after 24 months.
Hosted in Europe
The site runs on Vercel servers in Dublin, and the database is with Supabase in Ireland.
AI doesn't publish on its own
Texts the AI suggests in the admin are saved by a person; the chat assistant on the site changes nothing and doesn't confirm bookings.
Check for yourself
Don't take our word for it.
Three independent tests, each with the domain already filled in. They open in a new tab and check the site at the moment you run them.
We don't publish grades here: they're valid for the day they were measured. Run the test and see today's.
Report a vulnerability
Found a problem?
Write to us at the address below, ideally with the steps to reproduce it. We reply personally.
The same address is in the standard file /.well-known/security.txt