Careful with your brand.
And with your visitors.
Your hub carries your name, so it is built to the standard your security team expects: nothing runs that you did not approve, every response is hardened, and every change is on the record.
Four layers,
always on.
Security is how the platform is built, not a setting somebody has to remember.
Nothing runs
that you did not approve.
A summary of the protections built into the platform.
Content Security Policy
A fresh one-time value for every page request. Scripts without it, and frames to unapproved hosts, are refused.
No third-party scripts
Fonts, icons and analytics are served from your own site. An approved service is added deliberately.
Encrypted secrets
Mail, storage and webhook credentials are encrypted at rest.
Checked on every request
Console sessions are verified on the server for every page and every action.
Validated input
Forms and settings are checked on the server, and rich text is stored without HTML.
Calculators without code
Formulas are read by a purpose-built parser and never executed.
About
security.
Can we add a tag manager?
Yes, deliberately. An approved service is added by origin, and the policy allows that one and nothing else.
Who can publish?
Access is role-based. Owners manage everything, designers manage the design, editors write and publish, and viewers have read-only access.
Can we see who changed something?
Every sign-in, edit, publish and setting change is in the activity log, with who and when.
Ready for your
security review.
We will walk your team through it.
Talk to us