Legal

Security

This page describes how this website is built and protected. The security of the campaign platform itself is a separate and much longer conversation, and we walk through it in the briefing.

Version 1.0 · 15 September 2026

The short version. This site is a static page with one form. It has no database, no login, no user accounts and no stored submissions. An enquiry becomes an email and nothing else. There is very little here to steal, which is the strongest security property a brochure site can have.

01How the site is served

Encrypted in transit. The site is served only over HTTPS, with certificates issued and renewed automatically by our hosting provider. There is no unencrypted version.
Static delivery. The page is a single file served from a content delivery network. There is no server-side application to compromise, no content management system, and no plugins.
Almost no third-party code. We run no analytics, no tag manager and no advertising pixels. The page makes exactly two external requests: one for its typefaces, and one for the anti-bot check on the briefing form. Both are named in the privacy notice. We are working to remove the first.

02How the briefing form is protected

The form posts to a small piece of code running on our hosting provider's edge network. That code:

Stores nothing. There is no database behind the form. A submission is validated, turned into an email, and forgotten.
Validates every field and caps its length, and rejects a request whose body exceeds 24KB.
Carries a hidden trap field that a person never sees and never fills in. Submissions that fill it are discarded silently.
Rejects submissions completed impossibly fast, which is the signature of an automated script rather than a person.
Requires a Cloudflare Turnstile token, verified server-side against Cloudflare on every submission. A submission without a valid, unused token is rejected before any mail is sent. Turnstile is a privacy-preserving alternative to a CAPTCHA: most people see a tick and nothing else, and it is not used for advertising or cross-site tracking.
Never exposes credentials to the browser. The key used to send mail is held as an encrypted secret on the server side and is never present in the page you load.

Bot protection is deliberately quiet: a blocked submission receives the same response as an accepted one, so an automated attacker learns nothing from the difference.

03Where your enquiry goes

An enquiry passes through our hosting provider, a transactional email service, and our own mail provider, before arriving in the mailboxes we read. Each of those is named, with its location, in the privacy notice — we would rather you could see the whole chain than be told it is "secure".

Mail we send from this domain is cryptographically signed with DKIM, and the domain publishes SPF and DMARC records. That is what lets your mail provider verify that a message claiming to come from suffrage.ai genuinely did.

04What we do not claim

We would rather be trusted than impressive, so:

This site has not been independently penetration tested. It is a static page with one form; we would rather spend that budget on testing the platform that holds real campaign data.
We hold no security certification for this website. Any certification held by the platform is a separate matter and is evidenced in the briefing.
We make no uptime guarantee for this site. Service levels apply to engagements, in writing.

05Reporting a vulnerability

If you think you have found a security problem with this site, please tell us.

Email [email protected] with "Security" in the subject line. Describe what you found and how to reproduce it.

We will acknowledge within two business days and keep you informed while we fix it. We will not take legal action against anyone who reports a genuine issue to us in good faith, who does not access or alter data belonging to anyone else, and who gives us a reasonable opportunity to fix it before telling anyone else.

Please do not run automated scanners against the site. It tells us very little and costs us real money in bandwidth.

06If something goes wrong

If a breach affects personal data you have sent us, we will assess it immediately, tell the Information Commissioner's Office within 72 hours where the law requires it, and tell you directly without undue delay where the risk to you is high. We will tell you what happened, what it means for you, and what we have done about it.