cat /etc/trust

Security & trust

Security is a practice, not a badge. Here is exactly how this site is built and protected — and the honest state of my own compliance posture.

~/security/posture.sh

$ ./posture.sh --show-honest-state

[OK]   HTTPS enforced ..................... YES (HSTS preload-eligible)
[OK]   Security headers ................... YES (CSP, X-Frame-Options, etc.)
[OK]   Email hardening .................... IN PROGRESS (SPF/DKIM/DMARC)
[OK]   Privacy-first analytics ............ YES (no cookies, no trackers)
[OK]   Static site, no app attack surface . YES
[INFO] SOC 2 Type II — supported as part of
       Concepts2Code engagement (2025) ...... SEE BELOW
[INFO] Independent SOC 2 / ISO 27001 audit
       of my own practice .................. PLANNED

Honesty note: I have supported SOC 2 Type I and Type II compliance programs for clients, and I list those projects on my LinkedIn. I have not yet had my own solo practice independently audited — that work is planned as revenue supports it. I'll update this page the day that changes.

How this site is secured

Control	Status	Detail
HTTPS + HSTS	enforced	max-age 1 year, preload-eligible, includeSubDomains
Content-Security-Policy	enforced	self-only, inline styles/scripts allowed, no external origins
Frame options	deny	frame-ancestors 'none' — no clickjacking surface
Analytics	none	no cookies, no trackers, no third-party scripts. Zero data collected.
Architecture	static	pre-rendered HTML on an edge CDN — minimal attack surface

Data & privacy

This site sets no cookies and collects no personal data. There is nothing to consent to and nothing to sell. If you contact me, your message stays between us and is used only to respond to you. That's the whole policy — in one paragraph.

Report an issue

Found something wrong on this site? A typo, a broken link, a security issue — tell me directly.

report an issue