Security Overview

Encryption in transit

All traffic is served exclusively over HTTPS. Plain-HTTP requests are redirected, the minimum supported protocol is TLS 1.2, and HTTP Strict Transport Security (HSTS) instructs browsers to never downgrade.

Browser-level protections

Every page ships with a strict Content-Security-Policy, loads no third-party scripts, blocks embedding in other sites (frame-ancestors / X-Frame-Options), and disables MIME sniffing. There are no cookies and no cross-site requests to be hijacked.

Data minimisation

The only personal data this site handles is what you submit through its forms. Submissions are delivered over encrypted channels to our inbox; the backup copy held in our infrastructure is deleted automatically after 90 days. There is no user database and no credential storage on this site.

Abuse protection

The form endpoint is rate-limited at two independent layers, validates and caps all input, and rejects oversized or malformed submissions.

Email authenticity

Our domain enforces SPF, DKIM and DMARC (reject policy), so mail claiming to come from adaptivelighthouse.com that fails authentication is discarded by receiving servers. Genuine mail from us comes only from an @adaptivelighthouse.com address.

Reporting a vulnerability

If you believe you have found a security issue on this site, please tell us: info@adaptivelighthouse.com with "Security" in the subject line. We appreciate good-faith reports and will acknowledge and act on them promptly.