Security
A short overview of how we protect ironsignalworks.com and the production systems we deliver for clients.
Last updated: July 2026
Transport and hosting
The public site is served over HTTPS with HSTS. Hosting runs on Vercel with immutable asset caching for hashed builds and serverless functions for contact. Secrets (API keys) stay server-side and are never included in the client bundle.
Browser hardening
Responses include Content-Security-Policy, X-Frame-Options DENY, nosniff, Referrer-Policy, and a restrictive Permissions-Policy. External links are sanitized before use.
Contact and abuse controls
The contact endpoint checks request origin, applies per-IP rate limits, and verifies Cloudflare Turnstile when configured. Email delivery uses Resend with a verified sender domain.
Monitoring and releases
Client errors are reported to Sentry when a DSN is configured. Builds emit a release manifest (version + git SHA) so production incidents can be tied to a known artifact. We do not run session-replay tooling on this site.
Client project care
Managed care plans include SSL, uptime monitoring, backups, and deployment fixes. Target support response for care-plan clients is within one business day for priority incidents; uptime objective for managed hosting is 99.5% monthly excluding planned maintenance and upstream provider outages.
Security questions or responsible disclosure: web@ironsignalworks.com
Back to home