This page describes the measures that actually protect this website and the enquiries submitted through it. We list only what is in place — we do not claim certifications we do not hold.

Transport

All traffic is served over HTTPS. Requests to the insecure port are redirected, and HTTP Strict Transport Security instructs browsers to refuse an unencrypted connection for a year.

Access to the admin

The content management area requires a password and is reachable only after signing in. Passwords are stored as salted bcrypt hashes and are never recoverable in plain text. Sign-in attempts are rate limited per account and IP address, so a password cannot be guessed by brute force. Administration pages instruct search engines not to index them.

Form submissions

Every form is protected against cross-site request forgery. Submissions are rate limited per IP address, and scored by an automated spam filter before anyone is notified.

Uploaded images are checked by type and size. SVG files are stripped of scripts, event handlers, external references and embedded objects before they are written to disk, so an upload cannot run code in a visitor's browser.

Application data

Credentials for outbound email are encrypted before they are stored. Environment files, logs, backups and the application source are kept outside the public directory and are not reachable over the web.

Content changes are saved as drafts first and only become visible to visitors when published. Every publication is snapshotted so a mistake can be rolled back.

Backups

The database is backed up automatically every night and copies are kept for fourteen days, stored outside the public directory. Backups include the schema as well as the data, so a restore does not depend on any single tool.

Third parties

This website loads no third-party scripts, fonts, stylesheets or trackers. Nothing about a visit is disclosed to another company unless you choose it: the map on our contact page is loaded from Google only after you press "Show map", and never before.

The live chat works the same way: its window is loaded from our support service at support.cakraflash.com only after you press the chat button, and never before.

What we do not claim

We hold no security certification at this time. We do not publish an uptime guarantee for this website. Service levels, data residency and certification status for the beeoneten platform are confirmed in writing during procurement — ask us and we will tell you exactly where we stand.

Reporting a problem

If you find a vulnerability, please tell us at support@cakraflash.com before disclosing it publicly. We will acknowledge your report within three business days and keep you updated. We will not pursue legal action against anyone who reports a genuine issue in good faith and does not access or alter other people's data.