Security

How this site protects itself

We sell security engineering, so our own site should show its work. Every control below is live; you can verify the headers with a single request.

curl -I https://icdatt.com

Response headers

Seven headers on every response

Set in the application configuration, so they ship with every deploy and cannot drift from the documentation.

Content-Security-Policy

Limits where scripts, styles, images, fonts, connections and frames may load from. Scripts run only from this site and the analytics provider; frames are limited to scheduling providers; nothing may frame this site.

default-src 'self'; script-src 'self' 'unsafe-inline' https://plausible.io; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://plausible.io; frame-src https://calendly.com https://*.calendly.com https://*.hubspot.com https://meetings.hubspot.com https://cal.com https://*.cal.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests

Strict-Transport-Security
Tells browsers to use HTTPS only for two years, including subdomains, and allows preload-list inclusion.
```
max-age=63072000; includeSubDomains; preload
```
X-Frame-Options
Belt and braces with the CSP frame-ancestors rule: this site cannot be embedded in another page, which blocks clickjacking.
```
DENY
```
X-Content-Type-Options
Stops browsers guessing a file's type, so a crafted upload cannot be executed as a script.
```
nosniff
```
Referrer-Policy
Sends only the origin, not the full URL, when you follow a link to another site. Tool inputs encoded in URLs stay on this site.
```
strict-origin-when-cross-origin
```
Permissions-Policy
Disables camera, microphone, geolocation, payment and USB APIs for this origin. The site has no use for them.
```
camera=(), microphone=(), geolocation=(), payment=(), usb=()
```
Cross-Origin-Opener-Policy
Isolates this site's browsing context from windows that open it, which blocks a class of cross-window attacks.
```
same-origin
```

Application controls

Forms, secrets, dependencies, hosting

forms

Every form is validated and rate limited

Server-side schema validation of every field, with length limits.
A honeypot field invisible to people. Submissions that fill it are accepted and discarded.
Five submissions per address per ten minutes; the sixth gets a 429 and a mailto fallback.
Leads are emailed to a named mailbox. No lead data is written to a public store.

secrets

No secrets in the browser

Mail and webhook credentials live only in server environment variables.
Client code receives only public configuration (site URL, analytics domain, booking URL).
The client portal is a labelled demo with mock data and no real authentication.

dependencies

Pinned and audited

Dependencies are pinned through a lockfile and installed with a clean install in CI.
An audit runs on every build and blocks on known high-severity advisories.
The 3D hero, charts and assistant load lazily, so the first page load carries less third-party code.

hosting-and-privacy

HTTPS everywhere, cookie-less analytics

Hosted on a managed platform with automatic TLS and preview deployments for every change.
Analytics are cookie-less and record only the events listed below.
Tool inputs stay in your browser until you choose to send them.

cta_click (with location)
calculator_started and calculator_completed (with tool name)
brief_copied
form_submitted (with service)
booking_opened
resource_downloaded (with asset)

Responsible disclosure

Found something? Tell us

Email security@icdatt.com with the URL, the steps to reproduce and your contact details. We acknowledge within one business day and aim to fix confirmed issues within 14 days. We will credit you if you want credit and will not pursue good-faith research that follows these rules.

rules

Test only against icdatt.com, not client systems linked from it.
No denial of service, no social engineering of staff, no physical access attempts.
Stop and report as soon as you can demonstrate the issue. Do not access or retain data that is not yours.
Give us 14 days before publishing.

Next step

Want this standard on your own estate?

The same controls, scaled to your systems, start with a security posture assessment. 30-minute call to scope it.

Book a discovery call

30-minute call, no slides. We reply within one business day.