# Secure Encryption

> Statement of current practice. Last updated 2026-08-07.

All traffic to this site is served over HTTPS with TLS certificates
that renew automatically. That covers every page, every download,
and every form submission — nothing here travels in the clear.

The server behind it is hardened: strict security headers, a host
firewall, and internal admin services that are not reachable from
the internet. The automation service that receives form submissions
is served only over HTTPS, and the email-sending key it uses lives
in an encrypted credential store on our own server — never in the
site's code.

The live delivery features were built on this footing before they
went live, as promised: app downloads are served over the same TLS,
and client sign-in links are delivered by email rather than any
password stored on this site. Anything we add next follows the same
rule — encrypted by default, before launch.