Security

The website uses React and Vite, with public pages prerendered as HTML. Lovable hosts the site. Cloudflare provides delivery and bot protection. The site does not collect payment card data or process payments.

The public site uses HTTPS. Its observed transport settings include HSTS with a one-year duration and subdomain coverage.

The public domain supports TLS 1.2 and TLS 1.3. Certificate-chain verification passed in the October 11, 2026 check.

The static hosting origin's region has not been independently verified. The inquiry database's location is listed below.

HTTP Content Security Policy, permissions restrictions, and framing restrictions are prepared for deployment. The October 13, 2026 check did not find them in the public response headers.

The form collects name, email, optional organization, optional approximate team size, who it is for, what is going on, and the desired change. It has no upload, payment, health, or financial account field.

Supabase validates submissions, verifies Cloudflare Turnstile, applies request limits, and stores accepted inquiries. The form uses encrypted HTTPS connections. The Turnstile token is not retained in the inquiry record. Resend handles notification emails when configured.

The inquiry database is hosted in Europe (Ireland) through Lovable Cloud's Supabase-based backend.

The connected database's encryption-at-rest configuration has not been independently verified.

Ordinary inquiries follow the 12 months after the last meaningful contact policy in the Privacy Policy. Daily cleanup protects records awaiting historical review, converted engagements, and documented legal holds. Routine logs under our control have a 30 days limit. Provider-operated logs follow their own terms.

Administrative accounts for the domain registrar, DNS, hosting, email, and code repository use multi-factor authentication.

Our operating policy requires access to match the work, a review when people or vendors change, and removal of access when it is no longer needed. Provider-account access reviews require separate operational evidence.

Changes are tracked in Git. The website separates public client configuration from server-side credentials. Privileged server secrets are not needed in the public website bundle.

Dependabot checks npm dependencies monthly. Builds verify page content, internal links, security policies, and public contact boundaries before publication.

Release policy requires owner review of changes and test results before publication. Dependency updates are reviewed through the same process.

Report a security concern to [email protected]. Use the subject “Security report.” The Vulnerability Disclosure Policy explains research boundaries and report handling.

We notify affected clients without unreasonable delay and within applicable contractual or legal deadlines when an incident requires notice.

The owner assesses reports, coordinates containment and recovery, and determines who needs notice. Automated uptime alerting and incident exercises remain under review.

Lovable Cloud takes daily database backups and retains snapshots for roughly 14 days. Daily snapshots were verified in the connected project's backup list on October 11, 2026.

The operating policy requires an isolated restore test each quarter and reapplication of deletions before a restored database returns to service. Database backups cover schema and data. Storage files require separate backups when used.

The first isolated restoration test remains pending.

Client backups and recovery requirements are agreed for each engagement. A website provider's backup service is not a guarantee of recovery for a client system.

The Subprocessors page identifies website providers and the telephony subcontractor used for relevant engagements. Engagements identify their own approved model providers, self-hosted environments, permitted data, and output review process.

For new engagements, our default model provider is the OpenAI commercial API. The Anthropic commercial API is an alternative when the agreed work requires it. The engagement identifies the selected service, processing location, retention, and permitted data before client information is sent.

Our policy requires a person to check AI output before delivery. Consequential actions require the responsible client's approval. We use the minimum information needed and keep provider model-training opt-ins disabled.

Provider data-use settings and contract terms must be confirmed for the selected service before client information is sent. A consumer chat account and an API can have different terms.

Arx Sable LLC has not undergone a SOC 2 audit.

Our security review maps website controls and remaining evidence gaps to the Security Trust Services Criteria. This review is not an independent attestation.

We can complete vendor security questionnaires on request at [email protected]. Answers describe the controls and scope of the proposed engagement.