Security
How this site is built and served, and the fastest way to tell us if you find something wrong with it.
Reporting something
Found a vulnerability in this site or in one of our products? Email hello@iamtec.ai with enough detail to reproduce it. A person reads it, and we acknowledge within one working day.
We will not threaten anyone for reporting in good faith. Please do not run automated scanning that degrades the service for others, and please give us a reasonable chance to fix it before publishing.
How this site is built
- Static files. No content management system, no database and no server-side rendering behind these pages, so there is very little to attack.
- No third-party scripts beyond the booking calendar on the contact page. No analytics, no tag manager, no advertising code.
- A restrictive Content Security Policy ships with every page. Scripts may load only from this site and the calendar provider; the browser refuses everything else.
- HTTPS only, with HSTS,
X-Frame-Options: DENYandX-Content-Type-Options: nosniff.
Forms
Submissions are handled by our host over HTTPS. Forms carry a honeypot field to absorb automated spam rather than a CAPTCHA, because asking a person to prove they are not a robot is a poor way to begin a conversation.
How our products behave
Our products propose changes and wait for a person to approve them. Nothing alters a live system on its own, and every proposed action carries its evidence. That is a design constraint, not a setting to be switched off.
Arrangements for a specific product, including where data is held, are set out in your agreement. Ask before you commit and we will put it in writing.
What we do not claim
We are not currently certified to ISO 27001, and we do not hold a third-party penetration test certificate for this website. If a certification is a requirement for you, tell us early and we will say plainly whether we can meet it and by when, rather than after you have spent time on us.