What the website handles
The site runs on Cloudflare. Its D1 database stores privacy-choice records, optional website metrics, enquiries, newsletter requests and subscription preferences. It does not collect payment cards or offer public file uploads or customer payment accounts. Contact submissions use server checks and Turnstile. Newsletter submissions use server-side abuse controls without a CAPTCHA.
Security depends on configuration and ongoing work. We do not claim ISO certification, a SOC audit, continuous human monitoring, certified penetration testing or a service level unless it is separately evidenced and agreed.
Report a concern safely
Email support@lucidgrowthmedia.com with the subject Security report, or use your project's security contact. Identify the affected page or component, approximate time, observed impact and safe steps to reproduce the issue. Remove personal data, passwords, tokens and other secrets. Ask for a secure route before sending sensitive evidence.
If you encounter another person's information, stop accessing it. Report only enough detail to locate the issue. Do not download a dataset to prove the problem or publish sensitive evidence.
Permission for testing
This page does not authorise penetration testing, denial-of-service activity, social engineering, credential attacks, persistent access or data changes. It does not authorise testing of Cloudflare or other third-party systems. Get explicit written permission for testing beyond ordinary authorised use.
There is no automatic bug-bounty payment or legal safe harbour under this page. We assess good-faith reports, but cannot waive another party's rights or duties imposed by law.
Incidents and client systems
We assess suspected incidents for containment, evidence preservation, repair and any notices required by law or contract. Regulatory deadlines take priority over normal support processes.
Client systems have their own owners, access controls and agreed security scope. Use the project's urgent escalation route for an incident. A contact-form acknowledgement does not mean an emergency has been reviewed or resolved.
Access, records and communications
Use only accounts and access expressly authorised for the project. Do not share credentials or bypass access controls. Report loss of access, suspected compromise or an unintended data disclosure promptly through the agreed route.
We may restrict suspicious requests, preserve necessary evidence and involve service providers, advisers or authorities where lawful. Security responses must be proportionate, respect confidentiality and follow the Privacy notice. We do not use a security report as permission to reuse the reporter’s information for marketing.
No public policy provides a guarantee against every incident. Security commitments and any service-level remedies must be stated in the signed agreement. This page does not limit duties imposed by law.