Trust
Trust and security
This website, what you send us, the systems we build: each control, its status and its evidence.
Visitor statistics
Cookieless; no cross-site tracking
Backups
Regular, encrypted, restore-tested
Access
Least privilege, per environment
Disclosure
90-day coordinated target
01
This website, control by control
| Control | Status | Evidence |
|---|---|---|
| Identity and sign-in | In place | Hardware-backed MFA; roles enforced on the server |
| Least privilege | In place | Separate credentials per component; automation never approves |
| Environment separation | In place | Separate credentials per environment; synthetic test data only |
| Audit log | In place | Tamper-evident and verifiable |
| Backups and restore | In place | Regular, encrypted, restore-tested before they count; kept apart |
| Data collected here | In place | Form fields; cookieless statistics; inquiries 24 months, applications 12 |
| Encryption and transport | In place | HTTPS, strict certificates; signed DNS; enforced email authentication |
| Content policy | In place | Strict content security policy, checked on every build |
| Monitoring and rollback | In place | Checks from outside our hosting; every release can be rolled back |
| Scanning and CI gates | In place | Secret, code and dependency scanning on every change |
| Vulnerability disclosure | In place | security.txt; published policy; safe harbour; 90-day target |
Related: privacy statement, accessibility statement.
02
The systems we build for clients
| Control | Status | Evidence |
|---|---|---|
| Identity and sign-in | In place | Hardware-backed MFA, or your own identity provider |
| Least privilege | In place | Read cannot write; write cannot approve |
| Tenant separation | In place | Enforced in the database, per client |
| Data residency | In place | Decided before the build; EU regions for European clients |
| Backups and restore | In place | Encrypted, scheduled, restore exercised automatically |
| Secrets | In place | Managed store; never in source control |
| Patient data | In place | No protected health information enters, by design |
| Deploys | In place | Reviewed, verified releases |
Device distribution duties, the GDPR and Spain's LOPDGDD are designed into the workflow: governance.
03
Commitments
- Patient data
- No protected health information enters Armage systems, by design; the forms here ask you not to send it.
- Measured statements
- Nothing here is described as immune to attack, and no uptime figure is published that we cannot evidence.
04
Reporting a vulnerability
Email security@arm-age.com with enough detail to reproduce it. Scope, safe harbour and the 90-day target: disclosure policy · security.txt.
05
Questions
Does arm-age.com track visitors?
Not across sites. Our hosting and security provider collects cookieless visitor statistics (page views and loading performance): no cookies, no cross-site tracking, no profiles. The forms run a bot check from the same provider. No advertising cookies, fonts or embeds from other companies.
Where does information from the forms go?
To Armage by email, kept for a limited time: inquiries up to 24 months after our last contact, applications up to 12 months after a decision.
Send us your security questionnaire
Or writesecurity@arm-age.com