How this site is built to protect your data

This page describes the security posture of the ScaleHardened website itself — the same engineering standards we hold client systems to. It is not a substitute for a project-specific security review, which we scope explicitly for every client engagement.

Secrets and credentials

API keys (including our OpenAI API key) are never present in browser-side code. Every call to a third-party AI provider happens from a server-side route handler; the browser only ever talks to our own backend. The lead-notification webhook destination is likewise configured server-side only — no client-side code can read or redirect it.

The chatbot

Messages you send to the website assistant are sent to our server, combined with grounded context from our own published content, and forwarded to our AI model provider to generate a response. We don't use chat conversations to train models, and the assistant is explicitly instructed not to request more personal information than it needs to route a genuine request to our team.

Forms and lead data

Contact and inquiry forms are validated on our server (not just in your browser), rate limited to prevent abuse, and protected against automated spam submissions. Submitted information is forwarded directly to our internal notification system so a real person on our team sees it — we don't sell or share it with third parties for marketing purposes.

Input validation

Every form and API route on this site validates input against a strict schema on the server before it's processed or forwarded anywhere — client-side validation is a UX convenience, not the security boundary.

Reporting a concern

If you believe you've found a security issue with this website, please email hello@scalehardened.com with details. We take reports seriously and will respond promptly.