--- title: "Security — CSP, HSTS, COOP standards we ship — TechTailors" description: "TechTailors' security architecture: single-tenant data isolation (your own account for every service that holds your data), Cloudflare edge protection, client-owned accounts, CSP and HSTS, and vendors audited for SOC 2, ISO 27001 and PCI DSS. Graded A+ by SSL Labs, Mozilla HTTP Observatory, and Security Headers." canonical: https://techtailors.agency/security/ --- # Security Security is the architecture itself. From edge-level DDoS protection to true single-tenant isolation across every service, every layer of your site is hardened by default. Security, graded ## Graded by three independent scanners We don't grade our own homework. Three independent scanners score this site's live configuration, and each link below runs a fresh scan of techtailors.agency, so you check the site, not our copy. 1. Grade: A+ Qualys SSL Labs TLS configuration: certificate chain, protocol support, key exchange, and cipher strength, graded per server endpoint. A+ on all four endpoints Captured 2026-08-27 [Run the scan yourself](https://www.ssllabs.com/ssltest/analyze.html?d=techtailors.agency) 2. Grade: A+ Mozilla HTTP Observatory MDN's scan of security headers and page behavior: CSP, HSTS, cookies, CORS, redirection, and framing protection. Score 110/100, 10 of 10 tests passed Captured 2026-08-28 [Run the scan yourself](https://developer.mozilla.org/en-US/observatory/analyze?host=techtailors.agency) 3. Grade: A+ Security Headers Scott Helme's scanner (a Snyk project) grading the HTTP response headers every visitor's browser receives. All six graded headers present Captured 2026-08-28 [Run the scan yourself](https://securityheaders.com/?q=techtailors.agency&followRedirects=on) We re-check the grades every quarter, alongside our published pricing comparisons, and keep dated captures in our repository. If a scanner ever grades us below A, that result stays published here while we fix it. Audited vendors, your accounts ## We sew in exactly the compliance you need We build on vendors that already hold *the audits regulated buyers ask about*, and every account is in your name. What applies to you depends on your business. **Patient records** HIPAA (Health Insurance Portability and Accountability Act, the US standard for protecting patient health data) **Card payments** PCI DSS (Payment Card Industry Data Security Standard. Stripe and BigCommerce are certified Level 1 service providers, the strictest level. Your own level depends on how many card payments you take.) **EU or California customers** - GDPR (General Data Protection Regulation, the EU's data privacy and protection law) - CCPA (California Consumer Privacy Act, California's consumer data privacy law) **ADA / accessibility** WCAG 2.1 AA **Enterprise security review** - SOC 2 Type II (System and Organization Controls 2, Type II: audited controls for security, availability, and confidentiality, evaluated over a period of time) - SOC 1 (System and Organization Controls 1: audited controls relevant to your customers' financial reporting) - ISO 27001 (ISO/IEC 27001, the international standard for information security management) - ISO 27017 (ISO/IEC 27017: security controls for cloud services) - ISO 27018 (ISO/IEC 27018: protection of personal data in the cloud) - ISO 27701 (ISO/IEC 27701: privacy information management, extending ISO 27001) - ISO 22301 (ISO 22301, the international standard for business continuity management) The certifications belong to the vendors, and *the accounts belong to you*. That means you can download Cloudflare’s SOC 2, ISO and PCI reports from your own dashboard without asking us. If you need another standard later, the foundation is already audited, so the site doesn’t need rebuilding. Nothing loads unless allowed ## Content Security Policy Every TechTailors site ships with a *whitelist-based Content Security Policy*, the strictest way to control what a browser may load on your pages. (If a hacker tries to slip a fake payment form or phishing iframe onto your site, the browser blocks it before anyone sees it. Even if a third-party script you use is later compromised, your visitors’ trust in your domain stays intact.) **How our CSP works** Our policy starts from `default-src 'none'`, blocking everything by default, then allows only the sources a site actually needs, one by one. On this site, that is our own domain for scripts, styles, fonts and analytics (Google Analytics 4 runs through Cloudflare Zaraz, from our domain). Cloudinary and our media domain serve images and video, Cloudflare Turnstile runs the spam check on forms, and Google’s PageSpeed API powers the Website Health Checker. Nothing else gets through. We also set `frame-ancestors 'none'` to prevent your site from being embedded in iframes on other domains (a defence against clickjacking (An attack where a malicious site overlays invisible elements to trick users into clicking something unintended)), and `form-action 'self'` to ensure form submissions only go to your own domain. This blocks form hijacking attacks before they start. On every page ## Security headers Beyond CSP, we set HTTP security headers on every page. Each one closes a specific class of attack. (Every connection to your site is encrypted and verified before content loads. Contact forms, login credentials, and payment data travel safely. Browsers physically refuse to render your site over insecure HTTP. That eliminates an entire class of attacks that exploit unencrypted traffic.) **The full list of headers we set** *Strict-Transport-Security* with a one-year max-age, subdomain inclusion, and preload eligibility ensures browsers will *only* connect over HTTPS, even if someone types `http://` manually. This eliminates man-in-the-middle attacks (Attacks that intercept unencrypted HTTP traffic to inject malicious content or steal data) on the initial connection. `X-Content-Type-Options: nosniff` prevents browsers from guessing file types (MIME sniffing), which attackers exploit to execute scripts disguised as other file types. `X-Frame-Options: DENY` provides a second layer of clickjacking protection alongside our CSP frame-ancestors directive. `Cross-Origin-Opener-Policy: same-origin` isolates your site's browsing context, preventing cross-origin windows from accessing it. `Referrer-Policy: strict-origin-when-cross-origin` limits what URL information is shared when users click outbound links. This protects your page structure from leaking to third parties. And our `Permissions-Policy` explicitly disables camera, microphone, geolocation, and payment APIs. A marketing website should never ask for hardware access. Stopped at the edge ## Cloudflare edge protection Before a request reaches your site, it passes through Cloudflare's global edge network: *300+ data centres*, on every plan. (If a competitor tries to take you offline, or a botnet probes your site for vulnerabilities (which happens to every public site within hours of going live), Cloudflare’s edge absorbs the attack before it reaches your code. Your site stays up and fast when you’d otherwise be down or compromised.) **What Cloudflare handles for you** Every client gets *enterprise-grade DDoS mitigation* and Web Application Firewall protection at the platform level. Cloudflare absorbs volumetric attacks before they consume any of your resources, and its WAF rules filter out SQL injection, cross-site scripting, and other common attack vectors automatically. Bot management runs pre-request filtering, blocking scrapers, credential stuffers, and automated abuse before your application code ever executes. Because your site is statically pre-rendered, there's no origin server to overwhelm. The edge serves cached HTML directly, making traditional DDoS against your infrastructure effectively impossible. No shared data ## Single-tenant isolation & client-owned accounts Most agencies keep every client’s data in their own shared accounts: one database, one analytics property, carved up across every client. We do the opposite. From day one, *every service that holds your data is its own dedicated, single-tenant account*: your own Cloudflare account, database, CMS, search and store. Your site runs as its own dedicated Worker on our Cloudflare account, never a slice of another client’s. (This is the part a shared-account agency can’t offer. A breach or vulnerability in another company’s site cannot reach your data, because your data was never in the same account or database to begin with. For regulated industries like healthcare and finance, single-tenant isolation is exactly what compliance auditors want to see, and it’s the default on every TechTailors build, not a premium upsell.) **How single-tenant isolation works** Take the database. Multi-tenant setups rely on a single application-level query filter (like RLS (Row Level Security: database policies that filter query results by tenant ID)) to keep tenants apart; if that filter has a bug, every tenant's data is exposed to every other tenant. We eliminate that risk entirely: your blog's content lives in its own database, in an account in your name (Cloudflare D1, or PostgreSQL on Supabase for Blogging Pro), and your store in its own SQLite database on Turso for e-commerce, each with its own credentials, its own backups, and its own network boundary. The same principle runs through the whole stack. Your domain, DNS and edge security settings sit in your own Cloudflare account, and your site runs as its own Worker with its own deploys and secrets. Your CMS, EmDash, runs in that same Cloudflare account, your search runs on a dedicated single-tenant Typesense cluster in your name, and your store is your own BigCommerce account. You can demonstrate data isolation at the *infrastructure level*, not just the application level, which is what auditors actually want to see. And every one of those accounts is in *your name from day one*. We're added as administrators to run DNS, TLS, and WAF rules on your behalf, never as the owner; billing and account ownership stay entirely yours, with full visibility into your accounts at any time. If you ever leave TechTailors, removing us as a member also cuts off the API tokens we use, and you keep every account and all your data, with nothing to negotiate. The running site is the one piece that stays with us unless you buy out the code. The isolation is permanent because the accounts were never ours to begin with. Fresh on every deploy ## Intelligent caching Our caching strategy is designed for both speed and security. It ensures users always see the latest content while maximising edge cache efficiency. (Returning visitors get near-instant page loads from local cache, but always see your latest deploy. Change a price on the homepage at 9am and visitors at 9:01am see the new price, not yesterday’s cached version. Speed and freshness aren’t a tradeoff.) **How our cache tiers work** HTML pages use `Cache-Control: public, no-cache`. Browsers may cache the page but must revalidate with the server before displaying it. This means returning visitors get fast `304 Not Modified` responses while *always seeing the latest deploy*. Hashed static assets (CSS, JS) get `max-age=31536000, immutable` (one year, no revalidation) because the filename changes on every build. Images and videos get a 30-day cache with the same immutable directive. This three-tier strategy ensures zero stale content while eliminating unnecessary round trips for assets that genuinely haven't changed. Someone else's breach can't reach your data. It was *never in the same account*. **Defence in Depth** No single security measure is enough. Our approach layers multiple independent defences (CSP, HSTS, single-tenant isolation, edge WAF, client-owned accounts) so that a failure in any one layer is caught by the others. This is the same *defence-in-depth* principle used by enterprise security teams. Wondering if your current site has these protections? Our [free Agency Audit](https://techtailors.agency/agency-audit/) asks specifically whether your site automatically blocks injection attacks like the ones a Content Security Policy defends against. ## Security without compromise See your exact monthly price, then talk to us when you’re ready. [Price Your Build](https://techtailors.agency/pricing/calculator/) [30-day guarantee on every new plan](https://techtailors.agency/policies/offboarding/#guarantee): an exit, not a refund. --- Prices as data: https://techtailors.agency/pricing.json · Site guide for agents: https://techtailors.agency/llms.txt