Security

Why we publish this

We're an identity and access management consultancy: holding our own site to the same standard we advise clients to apply is table stakes, not a marketing exercise. This is a plain account of what's actually in place, not a compliance certificate we haven't earned.

What's in place today

• Encrypted everywhere. Every page and asset on this site is served over HTTPS, with HSTS switched on: after your first visit, your browser refuses an insecure connection to this domain and its subdomains for a year.
• A restrictive content policy. A CSP and standard hardening headers limit what a compromised or injected script could do: scripts allowed only from this site and our booking calendar provider, no framing by other sites, and only our domain name, never the full page address, passed on when you follow a link to another site.
• Independently graded encryption. This site's TLS configuration holds an A+ rating from Qualys SSL Labs, one of the industry-standard tools for testing it.
• Nothing to steal. There are no user accounts, no database of our own holding personal data, and no personal data held by us beyond what you choose to submit through our Contact form, the message and call-back requests reachable via the "Talk to us" icon on every page, or the platform comparison request form on our Platform Comparison Reports page, plus the routine technical logs our hosting provider keeps (see our privacy policy). Less to hold means less to lose.
• No exposed source or secrets. Our source code lives in a private repository, and no credentials, API keys, or internal configuration files are ever served publicly from this domain.
• Authenticated email. Email sent from our domains is authenticated using SPF, DKIM and DMARC, with DMARC set to full enforcement: receiving mail servers are told to reject a message that fails authentication outright, rather than deliver it to a spam folder. Forging a message that appears to come from us is correspondingly harder.
• A way to reach us. If you find a genuine security issue, our published disclosure contact, security.txt, tells you exactly how.

What we're still strengthening

In the interest of being straight about it rather than glossing over it:

• We haven't commissioned an independent penetration test of this specific site. Given the site is static pages plus a single serverless function (the Health Check summary), with no authentication and no database of our own holding personal data (and that one function validates its input and has a daily limit on its AI spend, while the page shows a static result if the AI call fails), we don't think one would currently be proportionate, but we revisit that judgment as the site grows.

Found something? Tell us

If you've found a genuine security issue (not general feedback), please use the contact details in our security.txt file, or email contact@iam-tech.co.uk directly. Provided you act in good faith, avoid accessing or changing data beyond what's needed to demonstrate the issue, and give us a reasonable chance to fix it before going public, we'll acknowledge your report and won't pursue legal action over it.

Changes to this page

We'll update this page as our security practices evolve. The date at the top reflects the most recent revision.