Security policy
How we protect this website and the information you send us, and how to report a security issue.
Last updated 14 October 2026
- Encrypted everywhereEvery page is served only over HTTPS.
- Hardened and monitoredProtected servers, limited access and blocked abuse.
- Report an issueFound a vulnerability? Tell us and we will act on it.
Our commitment
Security is part of how we build and run technology for our clients, and it applies to our own website too. This page explains how we protect it and how you can help us keep it safe.
How we protect this website
We protect this website with the same practices we apply to client work:
- Encrypted connections only, using current TLS versions, with browsers told to always use HTTPS.
- Security headers that limit what pages may load and stop them being shown inside other sites.
- A protective network in front of our servers that filters attacks and abusive traffic.
- Hardened servers: key-based administrator access only, automatic blocking of repeated failed sign-ins, and regular updates.
- Limits on repeated requests to forms, downloads and sign-in.
- Email verification with a one-time code before the portfolio can be downloaded.
- Only the information we need is collected, and it is deleted after 24 months.
Security in our services
For client work, security controls, confidentiality and data protection obligations are agreed in each contract. Our teams follow secure development and operations practices, and access to client systems and data is limited to the people who need it.
Reporting a vulnerability
If you believe you have found a security weakness in this website or any InfyStrat service, please email [email protected] with the subject “Security report”. Include what you found, where, and the steps to reproduce it.
- We will acknowledge your report within 5 working days.
- We will keep you informed while we investigate and fix it.
- We will credit you if you wish, once the issue is resolved.
- We will not take legal action against research done in good faith under this policy.
Please do not
To keep our users and systems safe while you investigate, please do not:
- access, change or delete data that is not yours, or keep more than you need to show the issue,
- disrupt the service, for example with denial-of-service or heavy automated testing,
- try social engineering, phishing or physical attacks on our staff or offices,
- share details of the issue publicly before we have fixed it.
Fraud and phishing
InfyStrat staff use email addresses ending in @infystrat.com. We never ask for passwords or one-time codes by email or phone, and we do not change bank details by email. If you receive a suspicious message that claims to be from us, do not act on it and forward it to [email protected].
Changes to this policy
We may update this policy. The date at the top shows when it last changed.
Found a security issue?
Email [email protected] with the subject “Security report”.