Security

What this page covers

This page describes the protections around this website and the information it holds, which is mainly enquiries and newsletter signups. How client information is handled in engagements is set out in the Data and AI Governance policy. It describes what the site does today. It is not a guarantee that no incident can occur.

Encryption and the browser

The site is served over encrypted connections, and it tells browsers to use them for a full year. Every page carries a Content-Security-Policy that lets the browser run only the scripts and load only the resources the site itself names, protection against framing by other sites, a strict referrer setting, and a policy that switches off browser features the site does not use. The site shows no version numbers that would help an attacker.

Who can change the site

Only our staff can sign in, and each of them uses an authenticator app or backup codes as a second step; there is no sign-in without it. Passwords must be long, repeated failed sign-ins lock an address and a name out for a period, and the error messages do not reveal whether an account exists. Staff have the least access their role needs, a change to published content goes through a review and approval step, and each approval and change is recorded in a log that nobody can edit. The editing screens do not let anyone change code, and installing or updating software from the admin is turned off.

Forms and the data they collect

Every form is protected by a Cloudflare Turnstile check that the server verifies, checks that the request comes from this site, a timing check, a hidden trap field, and limits on how often one address can submit. Enquiry and signup records hold no IP address or browser details. Uploaded files are limited to a short list of safe types.

The assessments and calculators run in your browser and send nothing to us.

How the site is built and changed

The site uses one third-party plugin, for the second sign-in step, and no page builder. Code reaches the server only through a release built from the repository. Staging copies are protected by a password and are kept out of search engines. A set of automated checks for security headers, sign-in rules, form protection and consent is run before a release.

What we do not claim

XONIK does not claim any security certification, attestation or independent audit on this page. Nor does it claim that the site cannot be attacked or that no incident can occur. The protections above are described so that you can judge them for yourself, and the checks listed under how the site is built are run before each release.

Reporting a vulnerability

If you think you have found a weakness, please tell us through the responsible disclosure page. Write to the security address given there with what you found and how to reproduce it. We read every report and tell you what we decide to do about it.