Security & trust
What we do — and what we don't claim
We sell security tools, so here is exactly how we protect our own site and products, in plain words.
This website
- HTTPS only. Your browser is told to use a secure connection for this site every time, for two years.
- No analytics, no advertising pixels, and no tracking cookies. This site sets no cookies at all.
- Nothing loads from other companies — no outside fonts, scripts, or trackers. Our host, Cloudflare, handles basic request data (such as your IP address) to deliver and protect the site.
- A strict Content Security Policy: your browser may only run scripts and styles that come from this site, and never inline code. That is a well-known defence against injected scripts.
- Other sites can't load this site inside a frame, which blocks "clickjacking" tricks.
- Camera, microphone, location, payment, and other browser features are switched off on every page.
- Plain pages only: no logins, no databases, and no forms that store your information here.
You can check these yourself: they are the security headers your browser receives with every page.
When you buy
Purchases in our Hardframe Sites store are handled by Lemon Squeezy, our payment provider and Merchant of Record. We never see or store your full card details. The Privacy Policy lists exactly what we receive and why.
Our security products
- Holdwatch, Hearthward, and Leasewell are designed to run on your own machines, so your data stays on your network.
- Any automated summary in them is caged: it can only report what the evidence shows — it never invents.
- They are built security-first and tested as we go, and each product page says honestly where it's at.
- They have not had an independent security review yet. We won't call a product "secure" or sell it until it has.
What we don't claim
We hold no security certifications (such as SOC 2), and no outside firm has audited our sites or products yet. When that changes, this page will say so.
Found a security problem?
Please tell us: [email protected] or (417) 501-6375. The same contacts are in our security.txt file. Please give us a chance to fix it before you share it publicly, and don't access or change anyone else's data.