Enterprise-grade standards. Small‑business prices.
Small businesses deserve the same security, speed and care as the big end of town. This page sets out exactly how we build, and every claim on it is something you, or your IT people, can check.
- Content-Security-Policy
- default-src 'self'; script-src 'self'; connect-src 'none'; frame-ancestors 'none'
- Strict-Transport-Security
- max-age=31536000; includeSubDomains
- X-Frame-Options
- DENY
- X-Content-Type-Options
- nosniff
- Referrer-Policy
- strict-origin-when-cross-origin
- Permissions-Policy
- camera=(), microphone=(), geolocation=(), payment=() …
- Cross-Origin-Opener-Policy
- same-origin
- Cross-Origin-Resource-Policy
- same-site
- 0third-party requests. No outside scripts, fonts, trackers or ads.
- 0cookies, and nothing kept in your browser.
- <600KBfor the whole home page, animation included, before compression.
- 90automated renders before each release: 9 pages, 5 screen sizes, light and dark.
Measured on this website on 29 October 2026. Client sites are held to the same numbers or better.
Five things we never cut corners on.
None of this costs you extra. It is simply how we build.
-
01
Security
Static pages with nothing to hack: no database, no plugins, no admin login on the public site.
- A strict Content Security Policy, so injected scripts cannot run
- HTTPS everywhere, with HSTS telling browsers never to use plain HTTP
- Cannot be framed by other sites (clickjacking protection)
- Every outside library is self-hosted at a pinned version, with its licence
- A published security contact at /.well-known/security.txt
-
02
Privacy
Your customers are not the product. We do not add tracking unless you ask for it, and then only with consent.
- No cookies, analytics or advertising tags by default
- Forms open the visitor's own email app or go only to you
- A plain-English privacy policy written for your business
- Built with the Australian Privacy Principles in mind
-
03
Speed
Most of your customers are on a phone. Every page is built for a weak signal first.
- No page builder, no framework: hand-built HTML and CSS
- Served from Cloudflare's global network, close to every visitor
- Images resized and compressed, loaded only when needed
- Animation pauses when off-screen and switches off for people who ask for less motion
-
04
Accessibility
Everyone can use it, including people with a keyboard, a screen reader or low vision.
- Built to WCAG 2.2 level AA
- Text contrast measured on every page, in light and dark mode
- Clear focus outlines and touch targets at least 44 pixels
- Proper headings, labels and alternative text
-
05
Ownership
You are never locked in. If you ever leave us, you leave with everything.
- The domain is registered in your name
- You get the full source files and every account login
- Plain files that any web developer can host and change
- A handover in plain English, not jargon
Nothing goes live until it passes.
Before launch, and after every change, the site runs through the same automated checks we run on our own. If one fails, it does not ship.
- Renders cleanly at five screen widths, from a small phone to a wide monitor, in light and dark mode
- No requests to any outside website, and no errors in the browser
- No sideways scrolling and no broken images on any page
- Contrast measured on the rendered page, not guessed from the colour codes
- Search basics: titles, descriptions, sharing images, sitemap and business details for Google
- Security headers confirmed on the live site after launch
What we will never do.
- Invent reviews, ratings or awards for your site
- Hold your domain or your files hostage
- Add tracking you did not ask for
- Use tricks that pressure your customers into clicking
- Hide costs in the fine print
- Hand over a site we would not put our own name on
A bigger project, or an IT team with questions?
Multi-site businesses, member portals, booking systems and custom apps are scoped together, with a fixed quote. We are happy to fill in your security questionnaire.