Security overview
What is implemented on this website, and where its limits are.
Updated 15 October 2026
Current safeguards
The production site is served through Cloudflare over HTTPS. The contact handler validates field formats and lengths, limits request size, checks the request origin, uses a honeypot field and rate limits to reduce automated abuse. Rate limits are not a guarantee against every attack. Email content inserted into HTML is escaped. Browser security headers restrict framing and several browser capabilities.
Secrets and messages
The Resend API key is read from the server environment, not delivered in the browser code. The site does not offer visitor accounts, file uploads or card entry. Enquiries and copies pass through email providers; email is not end-to-end encrypted by this website. The form does not send messages to an AI provider. Read the privacy notice for processing details.
Share less at the first contact
Do not submit passwords, API keys, access tokens, health data or confidential attachments. Start with a short description and anonymised examples. Account access, data sharing, processing agreements and any project-specific security measures must be agreed before an integration is connected.
Report a problem
Send a concise report to hello@reclaer.com with the subject “Security report”. Include the affected URL, a minimal description and non-sensitive reproduction steps. Do not access other people’s data, perform denial-of-service tests, persist in a system or publish secrets. Reporting is not permission for intrusive testing. No paid bug-bounty programme or guaranteed response time is offered.
Scope and limitations
This is a factual website overview, not an independent audit, penetration-test report, compliance certification or guarantee of absolute security. No Reclaer ISO 27001 or SOC 2 certification is claimed. Provider certifications do not certify Reclaer. Security for a client application must be assessed and agreed separately. Material changes to this site will be reflected here.