# Data Protection

> Technical and organisational measures, stated plainly.
> Last updated 2026-08-06.

- **Transport encryption:** the site and every hop of the contact
  pipeline run over TLS (the site enforces HTTPS; delivery uses the
  provider's TLS).
- **Our own infrastructure first:** form submissions are processed by
  our self-hosted automation server on our own VPS — not a
  third-party automation cloud. The server is firewalled, and the
  contact endpoint accepts only this site's origin.
- **Processor discipline:** email delivery uses Resend in the EU
  region with tracking disabled. The API credential is scoped to
  sending only and stored solely in the automation server's encrypted
  credential store — never in code, never in the repository.
- **No admin surface:** this site has no online admin panel or CMS
  login to attack. Content changes happen locally on our machines and
  are deployed as static files.
- **Minimal blast radius:** because we collect almost nothing (see
  Data Minimisation), the worst-case exposure is the correspondence
  you already knowingly sent us.