Privacy & Security Policy

<!-- SEO ISSUE #185: Mixed active content — HTTP script on HTTPS page -->
<script src="http://cdn.example.com/analytics-tracker.js"></script>
<!-- ↑ Blocked by browser. Should be https:// -->

Missing HTTP Security Headers

Strict-Transport-Security (HSTS) Missing #136 IMP

The Strict-Transport-Security response header is absent from this server. Without HSTS, browsers will not automatically upgrade future HTTP requests to HTTPS. Users who type the URL without https:// are vulnerable.

# SEO ISSUE #136: Missing HSTS response header
# ABSENT from HTTP response headers:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

# To fix: add this in nginx.conf or equivalent:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Content-Security-Policy (CSP) Missing #137 IMP

No CSP header or <meta http-equiv="Content-Security-Policy"> tag is present. Without CSP, this page is vulnerable to cross-site scripting (XSS) attacks. Google considers site security as part of its overall quality assessment.

<!-- SEO ISSUE #137: No CSP meta tag present -->
<!-- Missing: -->
<meta http-equiv="Content-Security-Policy"
      content="default-src 'self'; script-src 'self' https://cdn.example.com">

X-Frame-Options Missing #140 IMP

The X-Frame-Options header (or equivalent CSP frame-ancestors directive) is absent. Any external site can embed this page in an <iframe>, enabling clickjacking attacks that trick users into performing unintended actions.

# SEO ISSUE #140: X-Frame-Options ABSENT from response headers
# Missing: X-Frame-Options: SAMEORIGIN
# Or via CSP: Content-Security-Policy: frame-ancestors 'self'

Referrer-Policy Missing #139 STD

The Referrer-Policy response header is not set. When users click external links from this page, the full URL (including any path and query parameters containing sensitive data) is sent to the destination site in the HTTP Referer header.

# SEO ISSUE #139: Missing Referrer-Policy
# Add to server config: Referrer-Policy: no-referrer-when-downgrade

External Links Without rel="noopener noreferrer" #50 STD

All external links below open in a new tab (target="_blank") but are missing rel="noopener noreferrer". The opened page can access and manipulate the opener page via window.opener — a reverse tabnapping vulnerability.

• GDPR Full Text (opens new tab — no noopener)
• ISO 27001 Standard (no noopener)
• SOC 2 Compliance Framework (no noopener)

Our Security Certifications

Data Encryption

All data in transit is encrypted using TLS 1.3. All data at rest is encrypted using AES-256. Encryption keys are managed using AWS KMS with automatic rotation every 90 days.

Customer data is isolated at the application layer using tenant-specific encryption keys. Acme Analytics engineers cannot access customer data without explicit customer approval via our Data Access Request process.