Security & privacy

Technical architecture

• The pages are static HTML and CSS with no client-side JavaScript.
• There is no content management system, visitor account, application database, public administration area, payment flow or file upload.
• The contact form posts to one same-origin PHP handler, which validates and length-limits input before handing a message to the host’s mail system.
• Pages use first-party images and system typefaces. No third-party request is required to render them.
• Hosting, DNS, registration and mail delivery use external providers whose underlying infrastructure is outside this website-level review.

Controls implemented in this release

Transport and canonical origin

Apache configuration redirects HTTP and the www hostname to the canonical HTTPS origin. HSTS is configured without making an unverified subdomain-wide or preload claim.

Browser policy

The release configures a restrictive Content Security Policy, content-type sniffing protection, framing protection, a restricted referrer policy, a permissions policy and same-origin opener isolation. The contact handler applies a hash-based policy to its server-generated reply page.

Published surface

Directory listing, Apache content negotiation and spelling correction are disabled. Unknown paths use a dedicated minimal 404 page rather than reproducing the contact form.

Contact handler

Source controls include type and length checks, email validation, CR/LF/NUL handling for mail headers, output encoding, a non-content honeypot, preservation of valid entries after an error and a site-wide hourly sending cap.

Regression checks

A local verification command checks the expected pages, internal links, security configuration, disclosure file, form location and deployment exclusions.

Privacy and data flow

Controller

METACOG SYSTEMS LTD, company SC900958, registered in Scotland. Registered office: 3A Albert Place, Aberdeen, United Kingdom, AB25 1RG.

Contact form data

The form collects a name, email address, optional organisation and message so that METACOG can read and respond to the enquiry.

Transmission and storage

The handler sends those fields to david.coigach@metacog.systems through the hosting provider’s mail system. It keeps no message copy in a website database.

Abuse prevention

The sending cap keeps only recent send timestamps in a temporary server file. It records no IP address, message content or visitor identifier in that file, and expired timestamps are removed when it is read.

Cookies and tracking

The pages use no analytics, advertising, tracking scripts, cookies, browser storage or service worker.

Provider and retention boundary

Hosting access logs, mail transport and mailbox storage are provider-controlled. Mailbox retention, deletion arrangements, international transfers and the legal basis for processing were not established in this technical review. This page therefore describes the observed and implemented data flow; it does not claim to be a complete legal-compliance assessment.

Your choices

Do not use the form for credentials, confidential records, special-category data or personal data about other people. For a privacy enquiry, use the email address above.

Known limitations

• The controls in this source revision have not yet been verified on the production host.
• The hosting provider’s infrastructure, operational controls and access logs were not tested.
• Registrar, hosting and mailbox account security, recovery arrangements, backups and retention were not independently verified.
• DNSSEC, certificate-authority restrictions and strengthened domain email policy require provider-side decisions and were not changed by this release.
• No penetration test, port scan, credential test, load test or attempt to exploit the site was performed.
• The live contact form was not submitted, so end-to-end mail delivery and authentication alignment were not verified.
• Unknown vulnerabilities may exist even where the listed checks pass.

Reassessment

This record should be reviewed after a material change to the site, hosting, form, mail path, domain configuration, visitor data flow or third-party dependencies; after a relevant incident or vulnerability report; and otherwise no later than 27 September 2027.

This record is evidence about a dated and limited review. It is not a guarantee that the site cannot be compromised, a penetration-test report, a certification or an organisation-wide security assessment.

Reporting a security problem

Email david.coigach@metacog.systems with the affected address and enough detail to reproduce the issue. This route is also published at /.well-known/security.txt.

In scope

This website, its public pages and files, and its contact form.

Out of scope

The hosting provider’s systems, accounts, mailboxes and anything not served from this site.

Please do not

Run denial-of-service or load tests, test credentials, use social engineering, access other people’s data, change or delete anything, or continue beyond the minimum needed to show that a problem exists.

Response

Reports will be reviewed and prioritised according to their likely impact. No response-time service level is offered.

Good-faith research

Report promptly, minimise data access and do not change or publish other people’s data. Obtain written permission before any active testing beyond passive observation.

Payment

There is no bug-bounty programme and no payment for reports.