SECURITY / GOVERNANCE

Clear boundaries.<br/>Reviewable decisions.

This page explains the website’s current controls and the principles we propose for client workflow implementations. A target control is not a certification or an audited guarantee.

Current disclosure. No SOC 2, ISO 27001, independent penetration test or production Workflow Factory certification is claimed. Client-specific controls, data terms and service targets must be agreed before access is granted.

This website

Assessment inquiries are validated on the server
Same-origin submission checks and one-use form tokens
Honeypot, minimum completion time and rate limits
No public endpoint lists or retrieves submitted inquiries
No advertising pixels or third-party analytics enabled

Client workflow design

Least-privilege accounts and explicit integration permissions
Human approval for agreed consequential actions
Separate test data and controlled release gates
Idempotency, bounded retries and a documented recovery path
Evidence and retention requirements agreed by workflow

Proposed implementation principles. Verified per engagement, not audited platform claims.

DATA & OPERATING BOUNDARIES

Data minimization

Collect what a defined process requires. Keep passwords, secrets and sensitive client records out of public inquiry forms.

Human authority

Name the approver and escalation owner. A missing approval pauses the work rather than granting permission.

Recovery & evidence

Make retries bounded, preserve meaningful event evidence and agree how failed work is reviewed or rolled back.

Client portal architecture

Future authenticated client operations are reserved for a separate application boundary: tenant-scoped records, server-side authorization on every resource, explicit roles, separate secrets and audit access. No client portal or shared client account is enabled on this website.

Raise a security or privacy question