Security

Posture

Business Factory Corporation operates this website and its form backend on DigitalOcean in the United States. We follow security-by-default principles: HTTPS only, no analytics or advertising trackers, least-privilege access to stored data, and bot screening, server-side validation and rate limiting on every form submission.

Infrastructure

• Static site hosting: DigitalOcean App Platform, built from the public source repository and served through DigitalOcean's content delivery network.
• TLS: Certificates issued and renewed automatically by DigitalOcean. The site and its form endpoint are served over HTTPS only.
• Form backend: A DigitalOcean Function that confirms each submission passed Cloudflare Turnstile, validates it, limits how often one connection can submit, and stores it. No credentials are exposed to the browser.
• Database: DigitalOcean Managed PostgreSQL. Connections are encrypted and accepted only from our own app; the database is backed up daily.
• Notifications: A copy of each submission is emailed to us through Resend.
• DNS: DigitalOcean DNS.
• Email: Google Workspace, with SPF, DKIM and DMARC published on the domain.

Third-party dependencies

The website loads two external resources in your browser:

• Google Fonts — typography (Newsreader and Public Sans families).
• Cloudflare Turnstile — on pages with a form, to check that a submission comes from a person rather than a bot. Cloudflare processes information about your browser and connection to make that check.

Neither is used to build a profile of you. We use no analytics platforms, no advertising trackers, and no behavioral profiling. On our servers, form notifications are delivered through Resend, which receives the contents of a submission but nothing about your browsing.

Data handling

The only personal data we process is what visitors submit through the site's forms, plus the IP address and browser type recorded with each submission for abuse prevention. See our Privacy Policy and Privacy Choices pages for full detail on collection, retention, and deletion.

Responsible disclosure

If you believe you have discovered a security vulnerability affecting this website, please report it privately to [email protected] with the subject line “Security Disclosure.” We commit to:

• Acknowledging your report within five business days.
• Providing a remediation timeline within fifteen business days.
• Not pursuing legal action against good-faith researchers who follow this policy.

Please do not publicly disclose a vulnerability before we have had reasonable time to remediate. Please do not access, modify, or destroy data belonging to other users. Please do not run automated scans that degrade service for other visitors.

Open source

The source code for this website is published at github.com/AlbinoRacoon/bizfactorynv-site. Independent review is welcome.

Contact

Security inquiries: [email protected] · Reno, Nevada, USA.