Business due diligence intelligence
What actually protects a report and the data behind it, listed plainly. Nothing below is a certification or an audit result — it is a description of the controls that are actually implemented today.
A report is reached through a link, not a password. Each link carries a high-entropy token generated with a cryptographically secure random source — not a sequential ID and not derived from anything guessable about the case — that works until the link expires or is revoked. It is deliberately reusable rather than spent on first open: a corporate mail scanner that opens the link before the customer does must not use it up first. The token itself is never stored: only its hash is kept, so reading the database does not hand over working links.
Every link has a server-side expiry, and can be
revoked before it expires. Report pages are served with
Cache-Control: no-store, no-cache, must-revalidate, private
and X-Robots-Tag: noindex, nofollow, noarchive, so a shared
cache or a search engine has no legitimate way to hold a copy.
The public lookup, screen-request and contact
endpoints are rate-limited server-side, and the contact form carries a
standard honeypot field to filter automated submissions before a
person ever sees them. /robots.txt and a sitemap exist for
crawl guidance only — neither is treated as protecting anything;
the access controls above are what actually do that.
What is sent to which processor, and why, is documented in full on how your data is handled — this page does not repeat it so the two cannot drift apart. That page is also where an open gap is recorded rather than hidden: there is currently no automated retention or deletion cycle, and a report's data is kept until removed by hand.
Some research steps use an AI processor against publicly retrieved source material. What is sent to that processor, and what is not, is covered on the same data handling page rather than duplicated here.
There is no dedicated, monitored security-disclosure
address or security.txt yet — publishing one before
it is actually staffed would be worse than not having it. If you find a
security issue, use the contact page and say
plainly that it is a security report; a person reads every message
that arrives there.
No security certification, penetration test, cyber insurance policy or compliance framework is claimed here, because none has been completed. This page will be updated if and when that changes — not before.