Security on the site and in the building

Pages are served with security headers configured in the application, including a content security policy, frame restrictions, and a nosniff header. Transport security is enforced on the hosted deployment. Customer details submitted through the site are limited to people who need them to answer you.

The warehouse uses access control, cameras, and cycle counts. Those controls are in place today. This page still is not a certification, and counsel should read it before launch.

Hosting and software vendors are part of the stack. We keep the site's dependencies current as part of ordinary upkeep. That is maintenance, not a claim that every risk is gone.

Email through the contact page and mark it as a security report. Include the page and what you saw. Please give us a chance to look before you publish the details.

A lawyer should review this draft before launch. It describes intent and a few technical facts about the site. It is not a security audit.