Security Practices

Last updated: July 2026. This is a standard draft template — have it reviewed by qualified counsel before relying on it.

1. Infrastructure

Orbital is deployed on Cloudflare's global edge network. Traffic is served over HTTPS/TLS everywhere, DDoS mitigation and bot filtering are handled at the network edge, and static assets are served from a hardened CDN rather than an origin server we manage directly.

2. Application security

between requests.

against credential-guessing attempts.

• Server-rendered pages run in an isolated Workers runtime with no persistent shared state
• All form submissions are validated on the server and protected against automated abuse.
• Administrative areas (once live) require authenticated sessions and are rate-limited
• Dependencies are kept current and reviewed for known vulnerabilities.

3. Data handling

Personal data collected through this site (contact, booking, and subscription forms) is stored in access-controlled infrastructure and is never used outside the purposes described in our [Privacy Policy](/legal/privacy).

4. Incident response

If we become aware of a security incident affecting personal data, we will investigate promptly, take steps to contain it, and notify affected individuals and any relevant authority as required by applicable law.

5. Responsible disclosure

If you believe you've found a security issue affecting this site, please email hello@orbitalwebstudio.com with details. We ask that you give us a reasonable opportunity to investigate and address the issue before any public disclosure.

6. Contact

Questions about our security practices can be sent to hello@orbitalwebstudio.com.