What is implemented, not what is intended.

A session is a token signed with a key that is not in the repository. If the signature cannot be verified nobody is considered signed in — the system fails closed, not open. Passwords are stored with bcrypt and never compared as text, and an attempt with an unknown address takes the same time as one with a known address, so the form cannot be used to learn who holds an account here.

Registering with an address already on file and registering with a new one return byte-identical responses. Password recovery answers identically for a known and an unknown address. The only difference is the message that reaches the address owner. For a firm whose client list is part of its business, that is a disclosure question before it is a security one.

Password recovery: four attempts per fifteen minutes. Registration: five. Contact, support and newsletter forms: twelve per minute. The numbers live in the code, not in a policy document.

HSTS for two years with subdomains and preload. Framing inside another site is refused outright. Content-type sniffing is off. The content policy names no external script host — because there is not one: no analytics tool and no third-party script on any page. A permissions policy closes camera, microphone, location and payment.

Six ranked roles, checked on the route on the server rather than on the navigation — hiding a link does not stop an address being typed. A forbidden section answers exactly as a nonexistent one does, so nobody learns of a feature by being refused it.

No two-factor authentication yet. No independent penetration test. No SOC 2 and no ISO 27001 — and we claim neither. They are listed here because a security page with no gaps in it is a security page that was not written honestly.