Standards

How we build

A short list of standards I hold every project to. If you would like proof, ask — most of these are verifiable from the live site or app binary.

Privacy by default

  • No third-party cookiesHow to verify: Open browser devtools → Application → Cookies. You will see only the session cookie required to operate the site.
  • No third-party analytics scriptsHow to verify: Cookieless analytics only (Plausible/Umami). View page source and inspect script tags.
  • Self-hosted fonts (no Google/Adobe Fonts CDN)How to verify: Inspect Network tab — fonts load from same origin, never fonts.gstatic.com.
  • Personal data encrypted at restHow to verify: Free-text fields in submission DB encrypted with industry-standard symmetric crypto. Names + emails kept legible for operational reply.
  • Sensible retention, hard-deletedHow to verify: Cron job on the server deletes contact form submissions older than 24 months. Source code review available on request.
  • Native apps respect platform privacy APIsHow to verify: Apple App Store privacy labels + Google Play data safety form filled in honestly. No SDK that exfiltrates beyond what is declared.

Craft you can verify

  • Every design original per clientHow to verify: No template purchased and re-skinned.
  • Every diff is read before it reaches productionHow to verify: Nothing lands unread and no copy is published unedited. Commit history is yours at handover.
  • Native apps written in platform languagesHow to verify: iOS in Swift / SwiftUI. Android in Kotlin / Jetpack Compose. No cross-platform wrappers unless you specifically ask.
  • Accessibility audit per releaseHow to verify: WCAG 2.2 AA on web. Native screen-reader testing on mobile. Audit report published per release.

Performance

  • Web landing page under 200kbHow to verify: Open Network tab on the homepage — total transfer size under 200kb on first visit.
  • LCP under 1.2s on 4GHow to verify: Lighthouse scores published per release.
  • Server-rendered HTMLHow to verify: View page source — full content visible on first response. JS adds polish, not content.
  • Native apps cold-launch under 1.5sHow to verify: Xcode Instruments / Android Studio Profiler trace published per release.

Security baseline

  • CSRF tokens on every formHow to verify: Inspect any form — hidden _token field present.
  • Rate limiting on form endpointsHow to verify: 10 requests / minute / IP on contact form. Cloudflare WAF as second layer.
  • Prepared SQL statements onlyHow to verify: No string concatenation in queries. Source code review available.
  • HSTS preload + CSP + X-Frame-OptionsHow to verify: curl -I against any URL — security headers present.
  • Native apps pin TLS for backend callsHow to verify: On request, I will share the certificate-pinning config in the build.

Hosting + ownership

  • You own the source code on full paymentHow to verify: Repository transferred to your GitHub / GitLab account at launch. Documented in every contract.
  • You own the app store listingsHow to verify: iOS / Android: developer accounts in your name. I have publishing access only while retainer is active.
  • Sub-processor list disclosedHow to verify: Privacy page lists every sub-processor (CDN, analytics, newsletter, payments). Article 28 DPA available on request.

I will publish the deploy diff for any release if asked. The repository is private; the standards are not.