Passwords are never stored in plain text — every account uses industry-standard bcrypt hashing. Admin accounts are role-based, so staff only see what their role needs, and repeated failed logins trigger a temporary lockout.
Every form on this platform is protected against cross-site request forgery (CSRF), and every database query uses parameterised statements to prevent SQL injection — the two most common ways small business websites get compromised.
Uploaded files are checked against an allowed-type list and a size limit before they're accepted, reducing the risk of malicious files being uploaded through public forms.
The platform is built to run over HTTPS, and session cookies are marked secure and HTTP-only so they can't be read by scripts or intercepted over an unencrypted connection once SSL is active on your domain.
Administrative actions — logins, content changes, user management — are logged with a timestamp and the account responsible, so there's a record of who changed what.
We don't sell visitor or client data to third parties. Analytics and advertising tools are opt-in through a cookie consent banner, and what's collected is described in our Data Protection Notice.
We'd rather be precise than impressive. We do not currently hold formal certifications such as ISO 27001 or SOC 2, and we don't claim GDPR compliance as a blanket guarantee — our practices are built around good security hygiene and, where relevant, Ghana's Data Protection Act, 2012 (Act 843). If your project has specific compliance requirements (healthcare data handling, government procurement standards, sector-specific regulation), tell us early so we can scope the project around them honestly rather than after the fact.
Every project comes with a written scope and pricing before work begins, clear communication about timelines, and a defined handover at the end — including admin access, documentation for anything custom-built, and training on how to manage your own content.