Security is part of every delivery
- 01
Hardened by default
Strict Content-Security-Policy with per-request nonces, HSTS, frame-ancestors none, referrer and permissions policies on every response — on this website.
- 02
Input validation and CSRF protection
Every form and API endpoint validates and strips input server-side with a typed schema, requires a client-bound signed token plus a proof-of-work solved by the browser, enforces a minimum fill-in time and rate-limits per client and globally.
- 03
Dependencies
Dependencies are pinned in a lockfile — on this website.
- 04
Least privilege
Secrets live in the hosting platform’s environment, never in code. Cloud accounts, repositories and API keys are scoped to what a service actually needs.
- 05
Client ownership
Source code, infrastructure definitions and documentation are delivered into repositories and cloud accounts owned by the client. We hold access only for as long as an engagement requires it.
- 06
Reviewed by the founder
Every architecture and every release is reviewed by the same person who scoped the project — there is no hand-off where security context gets lost.
What this website collects and who processes it
From you, this website collects only what its forms need to answer you. Each form shows exactly what it asks; the full list is in the Privacy Policy, Section 2. It sets no marketing cookies and uses privacy-friendly, cookie-less analytics.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting, edge network and privacy-friendly analytics | United States / global edge |
| Resend, Inc. | Transactional email delivery for the website’s forms | United States |
| GitHub, Inc. | Source code hosting and deployment triggers | United States |
| Namecheap, Inc. (Private Email) | Mailbox hosting for info@delionsoft.com — receives messages sent through the website’s forms | United States |
Client project data is processed under the terms of each engagement agreement and, where required, a data processing agreement; it never enters the systems of this website.
Found something? Tell us — we will act on it
We welcome good-faith security research on delionsoft.com and on the products we operate. Report suspected vulnerabilities to info@delionsoft.com or through the contact in our security.txt.
Please include steps to reproduce and, where relevant, the affected URL or endpoint. We acknowledge reports within 5 business days, keep you informed of progress, and credit researchers who wish to be credited once a fix is released.
Testing must not degrade service for other users, access or modify data that is not yours, or involve social engineering, physical attacks or denial of service. Good-faith research within these rules will not lead to legal action from us.
In scope: delionsoft.com and its subdomains; the products we operate, including Imperecta — imperecta.com and its pre-release deployments (for example imperecta.pages.dev).
Out of scope: Third-party services we use (hosting, e-mail delivery, code hosting); denial of service; social engineering; physical attacks; automated scanning that degrades the service for others.
What we do not claim
DeLion Software does not currently hold ISO/IEC 27001 or SOC 2 attestations. We say so plainly because unverified badges are worth less than a page that tells you exactly what we do. The founder holds Cisco CCNA Cyber Ops and other verifiable credentials listed on the About page, and is completing a Master’s in information systems security.
Security questionnaires and due diligence
Procurement teams are welcome to send vendor questionnaires; we answer them in writing and can sign an NDA and a data processing agreement before an engagement.
Tell us what you need to build, connect or decide.
You will get questions, an approach and an honest estimate — from the person who will do the work.