Information Security

Security is the substance of our work, so this page states plainly how this website is secured and how we handle client data and access during engagements. It describes what we actually do — no more.

How this website is secured

Static architecture, minimal attack surface

The website is prebuilt static content served from object storage behind a CDN. There is no server-side application, no database and no user accounts on the site itself — which removes the most commonly attacked components entirely.

Encryption in transit

All traffic is served over HTTPS with modern TLS, HTTP is redirected, and HSTS is enabled so browsers refuse to downgrade.

Access control on infrastructure

The AWS accounts behind this site are accessed through centralized single sign-on with multi-factor authentication and least-privilege roles. Deployments run through short-lived, identity-federated credentials — no long-lived access keys.

Infrastructure as Code

The hosting infrastructure is defined in Terraform and changed only through reviewed, version-controlled updates, so every change has an author, a reason and a rollback path.

Minimal data by design

The only personal data the site handles is what you type into the contact form. Spam and abuse are filtered by Google reCAPTCHA Enterprise, which loads only when the form is used.

How we handle client data in engagements

Client data stays in client environments. We work inside your cloud accounts and repositories under your access controls; we do not copy production data onto our systems.
Access is scoped and temporary: granted for the engagement, at the level the work needs, and revoked when the work ends.
Confidentiality is contractual — engagements run under NDAs and written agreements before any access is granted.
Secrets are handled in your secret-management tooling, never in tickets, chats or repositories.

Where an engagement has regulatory constraints — residency, sector rules, audit requirements — the controls are agreed in writing before work starts. The cloud architecture page describes how we design for compliance boundaries.

Reporting a vulnerability

If you believe you have found a security issue in this website or our infrastructure, email info@aqvantiq.com with enough detail to reproduce it. Reports are read by an engineer, acknowledged, and acted on. We ask that you give us reasonable time to fix an issue before public disclosure, and we will not pursue anyone who reports in good faith within these terms.

What we do not claim

We do not hold third-party security certifications for our own operations at this time, and we do not claim controls we have not implemented. Where a client engagement requires evidence of specific practices, we provide it for that engagement rather than a generic badge.