This page says what is actually in place, in the same plain language your infosec review will use. If your scan finds something this page does not say, tell us and we will fix one of the two.
HTTPS is enforced everywhere with HSTS. The marketing site is served by GitHub Pages, the demo runs on Cloudflare Workers, and the API runs in a container on a managed cloud platform behind Cloudflare's edge.
More than 1,100 automated tests run across the stack, and dependency, container and secret scanning runs on every commit and on a weekly schedule. Claims on this site about isolation and provenance are enforced by those tests, not by a policy document.
A hash chained point in time ledger records every watchlist and alert as published. Records are signed with Ed25519 and anchored to external timestamp calendars. You can verify independently, without trusting us: the public key and the per stream verification endpoints are public.
The public health endpoint reports liveness only and returns no internals. Operational detail, model state and data freshness live on a loopback gated internal endpoint, because a degraded pipeline is an operations matter, not a public broadcast. The honest public view is the status page, and every data payload carries its own as of stamp so staleness is visible where it matters.
demo.liquilens.in sits behind an access request and answers 401 until access is granted. It contains public record evidence and a synthetic treasury book. Nothing confidential is inside, so the gate manages access, it does not protect data.
Security contact and policy: /.well-known/security.txt. Or email [email protected] with the subject SECURITY. Reports get a fast human answer, and reporters who want credit get credit.
On 20 July 2026 the edge minimum TLS version was raised to 1.2 across our zones, DNSSEC went live on our domains, the public health endpoint was reduced to liveness only, and the demo host gained a full response header set including a content security policy. Changes like these land in the ship log, dated, like everything else. If your scan still shows an older state, it is cached; tell us anyway.