Security

This page describes the technical measures we take to secure pegbitstudio.com and the client portal at clients.pegbitstudio.com. It’s a summary of practice, not a compliance certification — see Section 12 of our Privacy Policy for how this fits our broader data handling.

1. Transport and infrastructure

• HTTPS is enforced site-wide with HSTS (Strict-Transport-Security, including subdomains and preload), so browsers refuse to load the site over plain HTTP once they’ve visited once.
• A Content Security Policy restricts which scripts, styles, and frames the site can load, reducing the impact of any third-party script compromise.
• X-Frame-Options: DENY and a frame-ancestors ‘none’ CSP directive prevent the site from being embedded in another site’s frame (clickjacking protection).
• X-Content-Type-Options: nosniff stops browsers from guessing content types in a way that can be exploited.
• Hosted on Vercel’s edge infrastructure, which provides DDoS mitigation and automated certificate management at the platform layer.

2. Application security

• No API keys, tokens, or secrets are ever shipped to the browser — the AI Brief feature calls Anthropic’s API from a server-side route only, with the key held in Vercel environment variables.
• The AI Brief endpoint is rate-limited per IP address to reduce abuse, and all input is length-capped and validated before use.
• The client portal uses passwordless, one-time “magic link” sign-in — we never store a password for you, so there is no password database to compromise.
• Client-role portal accounts can only ever read data linked to their own organisation. That boundary is enforced at the data access layer, not just hidden in the interface.

3. Data protection

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production systems and data is restricted on a least-privilege basis to the people who need it to deliver the work. See our Privacy Policy for the full list of processors and how long data is retained.

4. Certifications

We do not currently hold SOC 2 or ISO 27001 certification. If your organisation requires a specific compliance attestation as a condition of engagement, tell us during scoping and we’ll confirm honestly whether we can meet it.

5. Reporting a vulnerability

If you believe you’ve found a security issue affecting pegbitstudio.com or the client portal, email info@pegbitstudio.com with details. We don’t currently run a paid bug bounty, but we investigate every report and will credit responsible disclosure on request.

6. Changes to this page

We’ll update this page as our security practices evolve. We’ll update the “Last updated” date above when we do.