[ the part you cannot see ]
What holds underneath.
Three things a site built well has and a site built in a hurry does not. They are verifiable: the first two with the browser tools, the third by reading the documents.
- ✓Card, PayPal and bank transfer payments behind a single interface
- ✓Collections proof against double charging, guaranteed in the database
- ✓Quotes and receipts generated as PDFs, numbered without gaps
- ✓Separate roles and permissions: owner, collaborator, client
- ✓Apps installable from the browser, with no store in between
- ✓AI assistants that know the heritage and answer at any hour
- ✓HTTPS enforced, with HSTS extended to subdomains
- ✓Complete protection headers: framing, sniffing, referrer, permissions
- ✓Permissions enforced in the database (RLS), not only in the interface
- ✓Forms defended on four levels: per-IP and per-resource limits, honeypot, minimum time, origin
- ✓Keys and secrets server-side only, never in the browser
- ✓Private links with 32 random bytes, not guessable
- ✓Content Security Policy under test, in report-only mode
- ✓Privacy notice and cookie policy validated by a law firm
- ✓Cookieless analytics: no profiling, no advertising pixel
- ✓Data hosted in the European Union (Frankfurt)
- ✓Consent collected explicitly, with a stated purpose
- ✓Electronic invoicing through the Italian SdI, not spreadsheets
- ✓Multilingual site declared correctly (reciprocal hreflang)
The seventh security item says “under test” because it is: the Content Security Policy currently reports and does not block. We would rather write it than have you find out.