We hold our own data to the standard we sell.
Our whole pitch is auditable, defensible data. It would be hard to make that case while running a leaky site or hoarding personal information. This page sets out — in plain terms — how we secure the platform and how we handle the little data we collect.
Last reviewed: June 2026
Found something? Tell us first.
If you believe you've found a security vulnerability, email security@spatialsusty.com with a description and reproduction steps. We aim to acknowledge within two business days. Please don't open a public issue or test against live client data — give us a chance to fix it first, and we'll keep you in the loop.
Controls that are on by default — not a someday roadmap.
These ship enabled in production. We treat turning any of them off as a decision that has to be written down, not a quiet default.
Encrypted in transit, always.
HTTPS is enforced site-wide with HSTS (one year, including subdomains,
preload-eligible). Session and CSRF cookies are Secure and
HTTP-only.
Locked-down content policy.
A strict Content-Security-Policy (default-src 'self',
nonce-based scripts, locked frame-ancestors), plus
X-Frame-Options: DENY and
X-Content-Type-Options: nosniff.
Admin behind two factors.
Staff access requires a confirmed TOTP device — no second factor, no admin — and admin logins are rate-limited to blunt brute force.
Forms that resist abuse.
CSRF on every form. The contact form is IP-rate-limited with a honeypot and a one-shot signed timestamp to block replay and bot spam, on spoof-resistant IP handling.
Input sanitised on the way in.
Any HTML we author through the admin runs through an allowlist
sanitiser that strips scripts, event handlers, and
javascript: URLs — so a CMS edit can't become stored XSS.
Dependencies under watch.
Dependencies are pinned and scanned for known CVEs with pip-audit as part of our release checklist — a flagged package blocks the release until it's resolved.
We try to break it before someone else does.
The codebase has been through repeated white-box hardening passes and adversarial reviews, each one ending with regression tests so a fix can't silently rot. We keep a dated record of what was found and closed.
We collect almost nothing — on purpose.
This marketing site runs no advertising or analytics trackers, and sets only the essential cookies a secure form needs (a CSRF token; a session cookie for signed-in staff). The one third-party request is web fonts, served by Google Fonts.
- Contact form Your name, email, optional organisation, area of interest, and message — used only to reply to you.
- Abuse prevention Your IP address and a request ID, kept briefly to enforce rate limits and trace abuse.
- No tracking No advertising pixels, no analytics SDKs, no cross-site profiling.
Held only as long as it's useful.
- Contact submissions Kept only as long as needed to handle your enquiry. You can ask us to delete yours at any time.
- MyDataCompliance Collects only a company name and email; assessment data is auto-deleted after 90 days.
- Verdex evidence Per-plot evidence records are retained for audit purposes (≈5 years) and stay under the client's control.
- Access or deletion Email hello@spatialsusty.com or use the contact form, and we'll action it.
Each product carries its own data terms. This page covers the company and this website. For a Data Processing Agreement, our current subprocessor list, or product-specific data handling, get in touch and we'll share the relevant document.
Where it runs.
The platform runs on containerised infrastructure, served over HTTPS only, with a PostgreSQL database and a Redis cache. Application secrets are kept in environment configuration, never in source control. For our current list of subprocessors, or a region-specific answer, contact us.