Security

Security posture

CFW is a small advisory and systems practice. The public website is a low-risk marketing and intake surface hosted on Vercel, with domain and DNS managed through Cloudflare. The standalone public workflow audit app is operated separately at public-audit.vercel.app.

The security posture is based on data minimization, limited collection, reputable infrastructure providers, HTTPS, conservative access controls, and avoiding sensitive information in first-contact workflows.

Current safeguards

• HTTPS is active for cromwellfutureworks.com.
• Cloudflare manages domain registration and DNS.
• Vercel builds and hosts the Next.js website from the GitHub repository.
• The request-audit flow validates submissions server-side, uses a hidden honeypot path for spam handling, supports Cloudflare Turnstile server-side verification when configured, and stores leads through server-only Supabase credentials.
• Lead records are designed for Supabase row-level security with no public browser writes and no service-role key exposure to client-side code.
• Internal notifications use Resend with a per-lead idempotency key, and the protected maintenance check reports pending or failed notification records without exposing lead content.
• The public audit UI is hosted on Vercel and routes browser requests through a Render-hosted FastAPI service before database access.
• Google Workspace handles company email with MX, DKIM, SPF, and starter DMARC records configured.
• The website warns visitors not to include sensitive or regulated information in first-contact messages.

Public audit product safeguards

• Browser clients do not receive Supabase service-role credentials and do not write directly to workflow_audit database tables.
• The public API is designed to return sanitized response objects and avoid exposing raw AuditCase records, prompts, internal diagnostics, proprietary scoring logic, or Supabase row identifiers.
• Public report links are temporary, and stored inputs, stored outputs, CFW internal review copies, follow-up, and anonymized analytics depend on explicit consent choices.
• The public intake avoids file uploads and asks users not to submit sensitive, regulated, credential, trade-secret, or highly confidential details.
• The current free-tier deployment may have cold-start latency; that is a reliability limitation, not a data access exception.

Operational readiness

The production intake was reverified on August 25, 2026 across Supabase persistence, the selected Resend sender, a Delivered provider event, and receipt at audit@cromwellfutureworks.com. The exact labeled synthetic database row was removed after verification, while provider and mailbox evidence was retained.

CFW continues to monitor persistence and pending or failed notification state. Provider acceptance is not treated as permanent proof of future delivery, so sender, alias, database, and request-route changes require a fresh controlled gate.

The first-contact flow intentionally avoids file uploads and should continue to avoid sensitive client data until a more specific collection, storage, access, and retention process exists.

Data handling boundaries

CFW's initial request flow should collect only enough information to understand the business context, workflow problem, tools involved, and contact path. It should not collect regulated records, credentials, customer lists, financial account details, health data, HR records, or legal matter details.

Responsible reporting

If you believe you found a security issue involving CFW's public website or systems, contact security@cromwellfutureworks.com with a concise description, affected URL or system, steps to reproduce, and any relevant screenshots or logs.

Please do not access, modify, delete, disrupt, exfiltrate, or publicly disclose data. CFW does not currently operate a paid bug bounty program.

Vendor security

CFW relies on established providers for core infrastructure, including Vercel, Render, Cloudflare, Google Workspace, Supabase, OpenAI, and Resend. Vendor choices may change as the business and audit product mature.

No guarantee

No security program can eliminate all risk. CFW will continue improving safeguards as the website moves from marketing presence to operational lead capture and workflow audit delivery.