Website security

Marketing-site boundary

The public site is a statically generated Astro website delivered through Cloudflare, with one server-side endpoint for project inquiries. Providing healthcare engineering services does not make this marketing website a HIPAA-compliant system, a certified system, or a suitable channel for PHI.

Inquiry safeguards implemented in code

• The browser and server both validate required fields, formats, and length limits.
• The endpoint accepts same-origin JSON requests and rejects oversized or bot-like submissions.
• The Resend API key is read from an encrypted Cloudflare secret and is not shipped to browser code.
• The handler does not intentionally write names, emails, or project descriptions to routine application logs.
• Inquiry analytics contain service and page context but exclude personal form fields and free text.

Sensitive information

Do not submit PHI, patient information, credentials, API keys, secrets, or other sensitive data through this website. Use an agreed secure channel after an engagement has been scoped.

Claims this page does not make

This draft does not claim a security certification, penetration-test result, incident-response commitment, vulnerability-remediation deadline, data-retention period, or contractual security warranty. Those statements require verified evidence and owner approval.

Reporting a concern

To report a security concern involving this website, email hello@astericklabs.com with a concise description and a safe way to reproduce the issue. Do not include credentials, personal records, or live patient data. The owner should define a formal disclosure and response policy before approving stronger commitments.