Reduce unwanted load before application processing.
To reduce the risk of disruption from high-volume traffic, the public site is delivered through Cloudflare’s network using its standard DDoS protection. Unwanted load is addressed at the edge, and regular pages are served as static files.
The inquiry endpoint checks submission frequency, origin, request format, required fields and length limits on the server. It also verifies Turnstile tokens server-side, helping prevent invalid or excessive submissions from needlessly increasing storage and notification work.
Security design
Separate validation, storage and notification
Limit public entry points, store inquiries before notifying, and separate diagnostic logs from content.
Keep acceptance independent of temporary email failures.
The endpoint saves inquiry content and notification state in D1 before confirming acceptance. Queues then handles notification asynchronously. Failed email attempts are retried with a limit, and scheduled processing recovers pending inquiries that could not be registered with the queue.
Queues carries only a reference ID. The notification handler reads the content from D1, and the sender and recipient are fixed on the server. Input cannot turn the endpoint into a way to email arbitrary recipients. Acceptance and email delivery are treated as separate states.
Inquiry data has defined retention and deletion policies. The privacy policy explains retention and processing by service providers.
Make processing failures traceable.
We record reference IDs, result codes and durations for acceptance, queue registration after storage, notifications and retries. Workers Observability logs help investigate whether a failure is temporary and what processing needs attention.
Application logs exclude inquiry content, email addresses, IP addresses and validation tokens. Diagnostic state is kept separate from personal content. The contact and completion pages do not load GTM, and input is not sent to analytics events.
Review changes in an isolated environment before publishing.
Changes go through pull requests, tests and a build before deployment to an authenticated preview. Cloudflare Access protects that preview, which does not use production databases, queues or email. The change and its appearance can be reviewed before release.
CI / CD
Verify the same artifact before release
Review code, measure quality and inspect a protected preview before production release.
Limit what is public and what credentials can change.
Only HTML and assets selected by the build allowlist are served. Internal documents and secrets are excluded, and we verify that they cannot be retrieved. GitHub Actions dependencies are pinned by commit SHA and a lockfile, and CI credentials are limited to the permissions needed.
These are measures implemented on this corporate website. When features or configuration change, we review the data involved and the public boundary again. The privacy policy also explains how personal information is handled.
