How we keep your website secure, and how you can check it
No certificate can promise that a website is safe, so we do not lean on one. Below is what we set up on every site we build, and most of it you can test yourself in a minute, with free public tools, on this site.
“We use the latest versions” is something any agency can say, and you cannot check it. This article is the opposite: every protection is named, and next to each one is how you can see it for yourself. This site runs on exactly the setup described here, so it is the example you can test.
What every site we build gets
- HTTPS only. Every visit is encrypted, and HSTS tells browsers to refuse an unencrypted connection to the domain for two years, subdomains included.
- Protective headers. Another site cannot load yours inside a frame to trick visitors into clicks, browsers may not guess file types, the camera, microphone and location are switched off for the site, and the address of the page a visitor came from is trimmed before it is passed on.
- No keys in the browser. Passwords and API keys stay on the server. Nothing a visitor downloads contains one.
- Forms that can only write. Your contact form can add a message to the database, but the database refuses to hand one back to the public key the form uses. That rule is enforced by the database itself, so a mistake in our code cannot undo it.
- Limits on every public form. A spam trap, a cap on how many messages one connection can send in an hour, and a bot check where a form is open to everyone.
- Mail that cannot easily be forged. Mail from your domain is signed (SPF, DKIM and DMARC), so receiving servers can tell your real mail from phishing in your name.
Check it yourself
These four tools are free, run by independent organisations, and need nothing from us. Enter www.aktifystudio.com, or your own domain once your site is live.
- Internet.nl, website test · run by the Dutch Internet Standards Platform: HTTPS, IPv6, security headers and route security in one report.
- Internet.nl, email test · whether mail from the domain is signed against forgery (SPF, DKIM, DMARC).
- Mozilla HTTP Observatory · the security headers a browser receives, test by test.
- Qualys SSL Labs · the encryption itself: certificate, protocols and ciphers.
Updates, checked, not assumed
A website is built from open-source packages, and now and then one of them turns out to have a flaw. We check every project against the public advisory database those packages are listed in, and we update when a fix is published. On 25 October 2026 the code that runs this site, our booking and chat modules and our studio system had no known vulnerabilities in that database. The update is tested on a running copy before it goes live, because an update that breaks the site is a problem of its own.
Who holds your data
We do not run our own servers. Your site and your data sit with a small number of large providers, each of which is audited by an independent firm every year. You can read their reports, or a summary of them, on their own pages:
- Cloudflare · hosts and serves the site. ISO 27001 and SOC 2 Type II.
- Supabase · the database behind the site’s forms. SOC 2 Type II.
- Notion · where we keep your project: scope, decisions, approvals. ISO 27001 and SOC 2 Type II.
- Resend · sends the site’s mail. SOC 2 Type II.
- Stripe · takes payments. PCI DSS Level 1, the highest level for card payments. Card details go straight to Stripe and never pass through our servers.
Our own systems
- Our studio system, where your project lives, is behind a password and a second step: a code from an authenticator app. A stolen password alone does not open it.
- The chat on our sites is built to refuse what it should refuse. Before it went live we attacked it ourselves with 102 attempts in Dutch and English to make it leak its instructions, insult, discount or impersonate. None got through.
- The chat also has a bot check, a cap per visitor and a daily ceiling across all clients, so nobody can run up your bill by talking to it in a loop.
Found a problem? Tell us
If you think you have found a security problem on a site we built or run, mail contact@aktifystudio.com with “Security” in the subject. You get an answer within 24 hours, and we keep you posted until it is fixed. The same address is listed in our security.txt file, the standard place researchers look (aktifystudio.com/.well-known/security.txt).
- Show the problem without going further than you need to: do not read, change or delete other people’s data.
- Do not slow a site down or take it offline, and do not try to trick people into giving you access.
- Give us a reasonable time to fix it before you tell anyone else.
- Research done in good faith within these rules will not lead to legal action from us. We do not pay bounties, but we will thank you by name if you want us to.