Our approach
Feative Studios runs this Site on infrastructure we manage ourselves. We keep the set of third-party services small, so fewer parties handle your data.
How the Site is protected
- Encrypted connections: all traffic is served over HTTPS with TLS 1.2 or 1.3.
- Security headers: pages are sent with headers that block clickjacking (X-Frame-Options), stop content-type sniffing (X-Content-Type-Options), limit referrer data, and deny camera, microphone, and location access.
- Abuse limits: the contact form and scope estimator are rate limited per visitor to stop spam and automated abuse.
- Self-hosted data: leads, contact messages, and newsletter signups are stored in a database on our own server, not in a third-party CMS.
Where your submissions go
- Contact form: stored on our server and emailed to the studio through our Zoho mail account.
- Scope estimator: the project brief you enter is sent to an AI model provider (OpenRouter) to draft the estimate. Do not include confidential details you are not ready to share.
- Newsletter: your email address is stored on our server.
Details are in our Privacy Policy.
Staff access
- Our internal CRM requires a staff login.
- Sessions use signed, HttpOnly cookies that are only sent over HTTPS and expire after 14 days.
- Developer profiles are never listed publicly. They are only shared through private links that we can set to expire or revoke at any time.
Reporting a vulnerability
If you think you have found a security issue on this Site, email services@feativestudios.com with the subject "Security report". Please include:
- The page or endpoint affected
- Steps to reproduce the issue
- What an attacker could do with it
Please do not access other people's data, run denial-of-service tests, or share the issue publicly before we have fixed it. We will reply to confirm we received your report and keep you updated while we fix it.
Client projects
Security for client work, such as source code access, build pipelines, and confidentiality, is agreed per project in the statement of work or NDA.