Claremont Security
Contact
Claremont Security
Contact
A security firm should be willing to describe its own posture in public. This page is that description: how this site is built, where your data goes, and who we rely on. If you are evaluating us, hold us to it.
This site is a static application served over TLS from Vercel's edge network, with a single serverless function that handles form submissions. There is no CMS to compromise, no plugin ecosystem, no server we maintain by hand. The interactive tools run entirely in your browser by design, which means the most common way for a website to leak visitor data, sending it somewhere, simply does not apply to them.
Free tools: processed locally in your browser, transmitted nowhere. Contact and report submissions: verified by Cloudflare Turnstile, processed by our serverless function, delivered as email via Resend, and recorded in a private Supabase database (United States region) accessible only server-side; the database enforces row-level security with no public read or write access. Vault accounts: authenticated by Clerk; saved prompts and briefings are stored per-account and are not readable by other users.
Transport security with HSTS on every response. Bot and abuse controls on every form: Cloudflare verification, honeypots, timing gates, size caps, and input sanitisation against header injection. Secrets held as server-side environment variables, never in page code, and rotated when exposure is suspected. Least-privilege service keys: the browser-side database key can do nothing the row-level security policies do not explicitly allow. Deployments are versioned through source control, so every change to this site has an author and a history.
We keep the list short and each provider scoped to one job: Vercel for hosting and serverless execution, Cloudflare for Turnstile verification, Supabase for the database, Clerk for vault authentication, Resend for transactional email, Google Workspace for our own mailbox, and Calendly for scheduling you choose to initiate. We add providers reluctantly, because every additional vendor is additional surface.
No advertising trackers. No sale or sharing of inquiry data. No analytics that identify you personally. No AI training on anything you submit. No claims of certifications we do not hold: we are a small firm and we describe our posture plainly rather than borrowing acronyms.
If you believe you have found a security issue on this site, tell us at support@claremontsecurity.com with enough detail to reproduce it. We respond to good-faith reports quickly, we will not pursue action against good-faith research, and we credit reporters who want credit.