Security

Last updated September 30, 2026

Certifications

Pontelon is a new firm. We hold no SOC 2 report and no ISO 27001, FedRAMP or CMMC certification, and we do not imply otherwise.

What we do say is that we build against the OWASP Application Security Verification Standard and the NIST SP 800-53 control families. That is a statement about method rather than a certificate, and it is one you can check against our work.

How this site is protected

This site is small, and much of its security comes from that. The controls it does have:

• Static public pages. Every page a visitor reads is built ahead of time and served as a file. Only the contact form, the assistant and the admin panel run code per request.
• A strict content security policy. Nothing loads unless the policy names it, so there are no third-party scripts, fonts, analytics or embeds, and every inline script is pinned by its hash. HTTPS is enforced with HSTS, and the site refuses to be framed.
• No passwords to steal. The admin panel sits behind Cloudflare Access with one-time codes. The site checks the signature, audience and issuer of each request's token itself rather than trusting a header, and keeps no password hashes or sessions of its own.
• Least privilege, default deny. Staff hold one of four roles. An admin page that is not explicitly mapped to a permission is refused to everyone, owners included.
• Forms that refuse forgery. Every admin change carries a signed token and an origin check.
• Parameterized queries only. No database statement is built by pasting in user input.
• Limits on strangers. The contact form and the assistant are size-capped and rate-limited per client, and refuse requests if the rate limit cannot be checked.
• An assistant with little to give away. It answers about Pontelon only from this site's own pages, its replies can link only to pages on this site, earlier answers are signed so a visitor cannot rewrite them, and a daily budget stops it before it costs anything. It stores no conversations.
• Addresses we cannot read. Visitor IP addresses are stored only as a salted one-way hash.
• An audit log with no delete button. Administrative actions are recorded, and nothing in the code edits or removes an entry.

Reporting a vulnerability

If you think you have found a security flaw in pontelon.com, we want to hear about it.

1. Email security@pontelon.com with "Security report" in the subject line.
2. Describe what you found, where, and what an attacker could do with it. Leave working exploit code out of the first email; we will reply with a private way to send it.
3. Give us a reasonable chance to fix it before you tell anyone else.

What you can expect from us

• A reply, usually within two business days.
• An answer on whether we could reproduce it, and word when it is fixed.
• Credit by name if you want it, and none if you do not.
• No legal action over good-faith research that stays within this policy.

We do not run a paid bug bounty.

What this policy covers

pontelon.com, including the contact form endpoint and the admin panel. If you reach data that is not yours, stop there and tell us.

What it does not permit

• Denial-of-service or load testing, or scanning at a rate that slows the site for other people.
• Social engineering of our staff or clients, and physical attacks.
• Accessing, changing or copying data that is not yours, including other people's inquiries.
• Testing Cloudflare's own infrastructure. Report problems there to Cloudflare.

For our products, report issues to the same address. The promise of no legal action above covers pontelon.com only, so ask us before testing anything else.

A machine-readable version of this contact is published at /.well-known/security.txt, as RFC 9116 describes.

Work we do for you

Security obligations in a client engagement, such as confidentiality, incident notice and how findings are handled, are set by the signed agreement for that work. Nothing on this page changes that agreement.