Colophon / site policy

What this site loads, sets and stores

Nothing on this page needs to be taken on trust. Open your browser's network tab and reload.

We sell an architecture in which data cannot leave a building. The sales experience should obey the same rules as the product, so this site loads nothing from any host we do not run, sets nothing on your machine, and executes no code in your browser at all.

01 The claim

What this site does not do

No third-party requests. Every byte this page loads comes from this domain. No content delivery network, no font host, no embedded video, no remote image, no hosted icon set.
No cookies. None at all — not first-party, not third-party, not "essential". Nothing is written to local storage or session storage either. There is no cookie banner because there is nothing to consent to.
No JavaScript. Not a byte, on any page. The frequently-asked-question panels are native <details> and <summary> elements. Turning scripting off changes nothing about how this site behaves.
No trackers, pixels or tags. No analytics from anybody else, no advertising pixel, no retargeting, no tag manager, no session recorder, no heatmap.
No chat widget. A chat widget is a third-party script that can read the whole page, on the site of a company selling zero egress.
No forms. The two doors on this site are email addresses. Nothing you type is posted anywhere by us.

We do not currently run analytics of any kind. If that changes it will be a first-party, self-hosted counter with no cross-site identifier, and this page will say so on the day it goes live rather than afterwards.

02 Verify

How to check it, in about ten seconds

Open the developer tools in any browser, select the network tab, and reload this page. You should see a very short list, and every entry on it should be this domain.

The HTML document itself.
/css/main.css — one hand-written stylesheet, shared by every page.
Up to two files from /fonts/, both WOFF2, both served from here.
/favicon.svg.

That is the complete list. Then open the storage or application tab and look for cookies: there are none. Then look at the response headers, where a Content-Security-Policy permits 'self' and nothing else, scripts are forbidden outright, the referrer policy is no-referrer, and the permissions policy denies every browser feature there is — camera, microphone, geolocation and the rest — so that even a future mistake by us cannot quietly turn one on.

03 Built with

What it is built with

Markup: Hand-written semantic HTML5. No framework, no component library, no build step, no generated markup. Clean URLs come from ordinary directories and index.html files.
Styling: One stylesheet, /css/main.css, written by hand. Custom properties, CSS grid and flexbox. A print stylesheet, because this buyer prints things. Reduced-motion preferences respected — there is almost no motion to reduce.
Scripting: None.
Typeface: Open Sans, designed by Steve Matteson, licensed under the SIL Open Font License 1.1 and served from our own origin in the Latin subset at four weights and one italic. The full licence text is at /fonts/LICENSE.txt. Open Sans carries no glyph for the Indian Rupee Sign, so on this site that one character falls back to your system's own sans-serif — a small honest seam we would rather explain than hide.
Drawings: Inline SVG, drawn by hand in the markup. No image files, no icon font, no stock illustration.
Hosting: Static files on Cloudflare Pages. Security headers are declared in a _headers file that ships with the site, so the policy is part of the source rather than a setting somebody remembered to switch on.
Verification: The claim on this page is re-checked before every deployment. If it ever stops being literally true, this page changes first.

Physics, not promises.