Website security
- HTTPS and browser security headers protect website delivery.
- Form submissions require server-side validation and Cloudflare Turnstile verification. Request-size and rate limits reduce abuse.
- Submissions are sent as plain-text email to fixed company recipients. The handler does not execute submitted content or fetch profile links.
- Server credentials are held separately from website assets. The website’s Zoho authorization permits sending mail and does not permit reading inboxes.
- Application diagnostics are designed to exclude form contents and credentials.
Service providers
Cloudflare: website hosting, HTTPS, form processing and abuse prevention. Zoho Mail: business correspondence and delivery of enquiries and applications. Our Zoho account uses the Canadian region. GitHub: private source control and deployment integration; the form handler does not send submissions to GitHub.
Providers may process information outside Canada. Retention, processing locations and individual rights are described in our privacy policy.
Operational tooling
Our operational toolset includes Grafana for dashboards and alerting, Slack for team coordination, Google Cloud for cloud infrastructure and observability, and Datadog for infrastructure telemetry, logs and alerting.
Use, data access and retention depend on the engagement. This list does not mean website form submissions are automatically forwarded to those tools; the website workflow uses the providers listed above.
Assurance and service scope
This page describes the public website. Customer infrastructure controls, access, backups, incident responsibilities and response targets are defined in the written service agreement.
No Vulcan Vector SOC 2 report or ISO 27001 certificate is published or claimed here. This summary is not an independent audit or penetration-test report. Security questionnaires and available evidence can be discussed with hello@vulcanvector.ca.
Security contact
Send suspected vulnerabilities to support@vulcanvector.ca with the subject “Security report”, the affected URL and safe reproduction steps. Do not include passwords, tokens or personal information.
Testing must remain within authorised systems and must not disrupt services or access other people’s data. No paid public bug-bounty programme or response deadline is offered through this page. Customers should use their agreed channel for critical incidents.