Security that assumes the worst.

The platform

Identity and access

• Multi-factor authentication on by default. Dedicated-tier tenants ship with it mandatory and no grace period. Any bypass is recorded against the user, not hidden in a config file.
• Deny by default. Permissions are checked explicitly at every operation. A missing permission is a denial, never an assumption of consent.
• Four-eyes approvals on the decisions that move money or change a contractual position. Approved records become immutable and carry their approval chain.
• SAML / SSO for tenants that require federated identity.

Tenant isolation

• Row-level isolation is enforced at the data-access layer by global query filters, so a query that forgets its tenant scope returns nothing rather than everything.
• Enterprise and Dedicated tiers can take a dedicated database where the risk appetite or the contract requires physical separation.
• Every table carries tenant, created-by, created-date, modified-by and modified-date. There are no exceptions to this rule.

Data handling

• No hard deletes. Records are flagged deleted and remain recoverable, so an accident is not an incident.
• Personal contact data is encrypted at field level.
• Secrets live in a managed key vault with documented rotation, never in configuration files.
• Break-glass access is a documented, audited procedure rather than a shared password.

The audit chain

Each audit row stores a hash of its own content plus the hash of the preceding row. Altering any historical record breaks every hash after it, and verification reports exactly where the chain failed. Correlation identifiers tie every mutation back to the business operation that caused it.

AI-specific controls

• Content safety runs in both directions — on every message in and every response out — and fails closed. A classifier outage blocks the message rather than waving it through.
• PII is tokenised before it reaches the model and restored only on the way back to the person who owns it. The token map is held in memory for the turn and never persisted.
• Tool access is catalogued and gated. Tools above a tenant's tier are hidden from the model entirely — it cannot propose what it cannot see — and mutating tools require explicit human confirmation.
• Per-tenant spend caps with token count, latency and cost logged per call.

This website

A marketing site is a soft target: it is public, it is rarely patched, and it usually runs a content management system with an admin login. We took the structural way out rather than the vigilant one.

There is no server to attack

This site is compiled to static HTML, CSS and JavaScript ahead of time. In production there is no application server, no database, no CMS and no administrative login. The classes of attack that dominate web compromise — SQL injection, server-side template injection, authentication bypass, vulnerable plugins — have no surface to land on, because the components they target are not deployed.

Injection has nowhere to go

• No visitor input is ever rendered back into a page. There are no comments, no reviews, no search results, no user profiles. Stored cross-site scripting requires somewhere to store and something to render; neither exists.
• A Content-Security-Policy with no unsafe-inline and no unsafe-eval is enforced. Scripts and styles are served from this origin only, and the single inline script — the one that applies your theme before the page paints — is allow-listed by cryptographic hash computed at build time.
• The policy sets object-src 'none', base-uri 'none' and frame-ancestors 'none', closing off plugin injection, base-tag hijacking and clickjacking respectively.
• One third-party script exists on the whole site, and it is on the contact page only: Cloudflare Turnstile, for bot verification. Its policy exception is scoped to that single path; every other page permits scripts from this origin and nothing else. There is no tag manager, no analytics, no chat widget and no font CDN anywhere — fonts and assets are served from this origin, which removes the supply-chain path that has compromised many otherwise careful sites.

The form is the only input, and it is hardened

The contact form is the sole place a visitor can send us anything. It carries, in order:

1. A bot challenge (Cloudflare Turnstile) verified server-side. A token that fails, is missing, is reused or has expired is rejected before anything else runs.
2. A honeypot field, hidden from people and from screen readers, that automated form-fillers populate and humans cannot.
3. A minimum-time check. Submissions completed faster than a human could plausibly type are discarded.
4. Rate limiting per client address, enforced at the edge.
5. Strict server-side validation — allow-listed field names, type and length limits on every value, and rejection of anything unexpected rather than an attempt to sanitise it.
6. Header-injection defence. Newline and control characters are stripped before any value reaches an email header, and message content is delivered as plain text.

Validation runs on the server regardless of what the browser did. Client-side checks exist for the visitor's benefit, never for ours.

Transport and headers

• HTTPS everywhere, with HSTS and preloading.
• X-Content-Type-Options: nosniff — no MIME-type guessing.
• Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy denying camera, microphone, geolocation, payment and the rest by default.
• Cross-origin opener and resource policies set to isolate the browsing context.

Privacy as a security control

The ROI calculator computes entirely in your browser. Nothing you type into it is transmitted, stored or logged. We run no analytics and set no tracking cookies, so there is no visitor dataset to breach — the cheapest way to protect data is not to collect it.

Reporting a vulnerability

If you believe you have found a security issue in this site or in the Artec Neo platform, please tell us before you tell anyone else. Email security@citrisglobal.com with enough detail to reproduce the issue.

We will acknowledge within two working days, keep you updated on progress, and credit you when the fix ships if you would like us to. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate.