What this site does not do
- Sets no cookies at all
- Loads no third-party script, font or stylesheet
- Embeds no map, video or social widget
- Stores nothing you type, anywhere
- Has no login, no account area and no database
Security and data
How we handle security and your data
Most deals do not stall on the technology. They stall in procurement, waiting for a security questionnaire to come back. So here are the answers in public, once, for everyone.
This website
Start with what you can verify yourself, right now, with your browser’s developer tools open.
What it does do
- Serves a strict Content-Security-Policy that allows no external origin
- Forces HTTPS, and refuses to be framed by another site
- Keeps two preferences in your own browser: language and light or dark mode
- Hands your enquiry to WhatsApp or email, on your device, when you choose
- Contains no key, password or credential in any file it sends you
How we build
The practices we apply to customer systems, not only to this website.
Credentials
Secrets stay out of code and out of the browser. They live in server configuration, and they are rotated when anyone with access leaves.
Access
Named accounts rather than one shared login, permissions set by role, and access removed when it is no longer needed.
Environments
Development, testing and production are kept apart. Nobody tests against live customer data.
Backups
Configured, monitored, and restored as a test. A backup nobody has restored is not a backup, and we will tell you how long a full recovery actually takes.
Servers
Hardened on setup, updated on a schedule, monitored with alerts, and documented so somebody other than the person who built it can run it.
Dependencies
Kept few on purpose. Every library added is a future obligation and a future vulnerability to watch.
Your data, in a customer deployment
| Question | Answer |
|---|---|
| Where does data live? | On infrastructure you choose. We can run it, or deliver onto servers your own team controls. |
| Who owns it? | You do, always, and it is exportable in a documented format on request. |
| Who at Aim IT can see it? | Only the people working on your system, under named accounts, and only while that work is live. |
| Is it encrypted? | In transit, always. At rest, according to what the deployment requires, agreed with you in writing. |
| Are there sub-processors? | Only the ones your deployment needs, such as your hosting or payment provider. They are listed for you before launch. |
| What happens in an incident? | You are told, in plain language, with what we know and what we are doing, rather than after it is tidy. |
What we do not claim: we hold no security certification, we publish no penetration test we have not had done, and we are not a compliance authority. Where your industry requires a certified provider or a formal audit, we will say so and work alongside whoever holds that role. Claiming otherwise would be the fastest way to fail your procurement check.