Scope matters. A public marketing site and a regulated document-processing system should not be treated as the same security problem. OOKTAM applies controls according to the data, jurisdiction, integration and operational risk.
Public website baseline
- HTTPS through the hosting/CDN layer;
- Content Security Policy and restrictive browser security headers;
- minimal public data collection;
- server-side validation for lead submissions;
- Cloudflare Turnstile support for bot protection before automatic lead delivery is enabled;
- no production secrets committed to the repository;
- staging deployments kept out of search indexing; and
- build validation in GitHub before release.
Client-data rule
Do not send passwords, payment-card data, government IDs, health records, bank statements, tax documents or other sensitive information through the public project form. When a project needs sensitive data, OOKTAM first defines the hosting region, access model, processors, retention, deletion, backup, audit and incident-response requirements.
Vulnerability reporting
If you believe you found a security issue affecting the OOKTAM website, email security@ooktam.com with the subject “Security report”. Include the affected URL, reproduction steps and potential impact. Do not access, modify, download or retain data that is not yours; do not use destructive testing, denial of service, social engineering or automated high-volume scanning without authorization.
What OOKTAM does not claim
This public website does not claim SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR certification or any other certification that OOKTAM has not actually obtained. A regulated customer may require additional controls, contractual commitments, penetration testing, insurance or a private deployment before production use.