How this site and its data are protected

Transport and headers

All traffic is served over HTTPS with HSTS, and HTTP requests are redirected. The following response headers are applied to every response.

• Strict-Transport-Security with a long max-age and includeSubDomains
• Content-Security-Policy restricting script, style, image, frame and connect sources, including frame-ancestors to prevent framing
• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy denying camera, microphone, geolocation, payment and other capabilities this site has no reason to use
• Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy

Form and API handling

Every submission is validated server-side regardless of what the browser did. Client-side validation exists for usability, not for security.

• Server-side schema validation with explicit length and type limits on every field
• Human verification through Cloudflare Turnstile before a record is written
• Rate limiting per source, returning an explicit rejection rather than silently discarding
• A honeypot field hidden from people and assistive technology
• Duplicate detection so a resubmitted form does not create a second record
• Safe output encoding everywhere enquiry content is displayed
• A request identifier on every submission, carried into structured logs for tracing

Sample footage handling

Uploads are the highest-risk surface on this site and are treated accordingly.

• A private storage bucket with no public access and no directory listing
• Randomly generated object keys that cannot be guessed or enumerated
• File type validated by extension, declared MIME type and file signature, with anything failing rejected before storage
• A configurable size limit enforced server-side
• Access restricted by role and logged on every read
• Automatic deletion seven days after upload, scheduled at upload time

Secrets and logging

Credentials are never present in client code and never committed to the repository.

• All secrets are held in the platform secret store and injected at runtime
• No API credential is exposed to the browser under any circumstances
• Personal data is redacted before anything is written to a log
• Raw media never appears in application logs
• Private storage URLs are never written to browser logs or analytics
• Structured logs carry a request identifier so an incident can be traced without logging content

Agent-accessible tools

The WebMCP tools this site publishes are constrained so that an agent cannot take a consequential action on your behalf without you seeing it first.

• Read-only tools operate on a static snapshot of published content and can reach no internal data
• Any tool with an external effect requires a two-stage confirmation with a session-scoped token
• No tool can select, read or upload a file
• Tool input is validated against a strict schema and unknown fields are rejected rather than dropped
• Every tool call is logged in a visible panel on the page

Dependencies

Dependencies are pinned with a committed lockfile and audited as part of the build. Build failures on a known vulnerability are treated as blocking rather than advisory.

Reporting a vulnerability

If you believe you have found a security issue in this site, email infojp@ayonix.com with enough detail to reproduce it. Please give Ayonix reasonable time to respond before disclosing publicly. Testing that degrades service for other users, accesses data that is not yours, or involves social engineering of Ayonix staff is not authorised.