Straight Answers About How We Protect Your Data
We'd rather tell you exactly what we do and don't have in place than make vague promises. Here's what actually runs behind this site and the systems we build for clients.
Encryption in Transit
This site enforces HTTPS with HTTP Strict Transport Security (HSTS), and sets a Content Security Policy, X-Frame-Options, X-Content-Type-Options, and a strict Referrer-Policy on every response to reduce the attack surface for common web exploits like clickjacking and content injection.
Password & Session Security
Admin passwords are hashed with bcrypt and never stored in plain text. Login verification runs at a constant time regardless of whether the username exists, so failed attempts can't be used to guess which accounts are real. Sessions use signed JWTs rather than long-lived plaintext tokens.
Input Handling & Abuse Prevention
Every public form (contact, careers, partners, reviews, newsletter) validates input on the server, is rate-limited per IP address, and carries a honeypot field to filter out automated spam submissions before they reach our team. User-submitted content such as blog comments is sanitized before it's ever rendered back to other visitors.
Infrastructure
This site is hosted on Vercel with a managed PostgreSQL database. File uploads (resumes, media) go directly to Vercel Blob storage rather than sitting on an application server we'd have to secure separately.
Found a Security Issue?
If you believe you've found a vulnerability in this website or one of our client systems, please report it privately rather than disclosing it publicly. We commit to acknowledging reports and working with you on a fix before any public disclosure.
info@helvino.orgThis page describes technical measures in place today and will be updated as our practices evolve. For how we collect and use personal data, see our Privacy Policy.