Our own security posture, dated, gaps included.
Most agencies describe security in adjectives. This page is what we would hand a client about ourselves: what is enforced, what is partial, what is missing, and when it was last checked.
- HTTPS / HSTSEnforced, 180-day max-age
- Security headersCSP + standard header set
- SPFPublished
- security.txtPublished, RFC 9116
- llms.txtPublished
- DKIMSigning, selector x (verified at Gmail)
- DMARCEnforced, p=quarantine, reports on
Checked with dig, curl and the same header and DNS checks we run on client domains.
Can someone send email as itovio.com?
Not without failing authentication. SPF, DKIM and DMARC are enforced on the apex domain; the remaining steps are listed as such.
| Control | State | Checked |
|---|---|---|
| SPF | Published; authorised senders listed | 2026-10-29 |
| DKIM | Signing on the mail server (selector x, 2048-bit) and on the transactional sender (selector resend). Verified dkim=pass at Gmail. | 2026-10-29 |
| DMARC | p=quarantine, pct=100, aggregate reports to a monitored mailbox. Next: p=reject after one clean reporting cycle. | 2026-10-29 |
| MTA-STS and TLS-RPT | Not published. Planned after DMARC enforcement. | 2026-10-29 |
| Cold outreach | Sent from a separate subdomain so it never shares the apex reputation. | 2026-10-29 |
Where the site runs
- HostingVercel serverless functions behind Vercel's edge network; static assets cached at the edge.
- RegionApplication functions run in Vercel's Frankfurt region (fra1, EU) from the next deploy; the database is hosted by Supabase in the US East region, which is listed as a sub-processor in the privacy policy.
- TransportTLS 1.3 with HTTP/2; HSTS enforced with a 180-day max-age. Not yet on the HSTS preload list.
- HeadersContent Security Policy, X-Content-Type-Options, Referrer-Policy and frame protections set by Helmet.
- DatabasePostgres on Supabase (AWS us-east-1) for blog content and sessions; no client data is stored there.
- SecretsEnvironment variables only; no credentials in the repository or in client-side code.
What we collect and where it goes
- FormsName, email, company, website, message and a consent timestamp. Sent to our CRM (GoHighLevel) and to contact@itovio.com.
- AttributionA first-party cookie storing first-touch campaign parameters for 90 days, used only to attribute your own enquiry.
- AnalyticsGoogle Analytics 4, Microsoft Clarity and Usermaven, loaded only after you accept analytics in the cookie banner. Declining changes nothing else on the site.
- RetentionLeads without activity for 24 months are anonymised. Erasure requests are handled within 30 days via contact@itovio.com.
- Sub-processorsVercel, Supabase, GoHighLevel, Google, Microsoft, Usermaven, Trustpilot, and our email host.
If you find something
Email contact@itovio.com with the affected URL, steps to reproduce and your contact details. We acknowledge within two business days, keep you informed, and credit you if you want. Please do not access other people's data or disrupt the service while testing. The machine-readable version is at /.well-known/security.txt.
For clients, during an incident
WhatsApp +31 97010222488 reaches a person. Message at any hour; incident messages are triaged first.
Want this level of clarity for your own domain? That is the first deliverable of the cyber security pillar, or start with the free attack-surface check.
