How we handle your information.
Inquiries sent through this website pass a Cloudflare Turnstile check and rate limits, are stored in a Cloudflare D1 database, and are read in a private inbox behind Cloudflare Access; a notification with a message excerpt also goes to a private Discord channel. Confirmation and receipt emails are automatic; every other reply is reviewed by a person before it is sent. This page describes how the website works today.
What happens to an inquiry
Bot check
The form includes a Cloudflare Turnstile check. The server verifies the result with Cloudflare, including the expected action and hostname, before the inquiry is stored.
Rate limits
Submissions are limited per network address and per email address. The limits are counted against hashed values, not the raw address.
Storage
The inquiry is stored in Cloudflare D1: the details you entered, a secret-keyed hash of your network address, and the first 500 characters of your browser’s user-agent string. The raw IP address is not stored in the inquiry database.
Email confirmation
You receive a link containing a random 32-byte token. Only a hash of the token is stored, the link expires after 24 hours, and confirming takes an explicit click on the page. The token travels in the part of the link that browsers do not send to the server, and the confirmation page is not indexed and sends no referrer.
Draft and notification
Cloudflare Workers AI may prepare a draft reply, within a daily limit. A notification with your name, company, email address, the service you chose, a message excerpt, and the prepared draft is posted to a private Discord channel.
Reply
A person reviews the draft in the private inbox, can edit or reject it, and sends it only after your email address is confirmed. Email is sent through Cloudflare’s email service.
Access to the inbox
The inbox runs on its own hostname behind Cloudflare Access. In addition, the Worker validates the Access token, a signed JSON Web Token checked against the expected issuer and audience, on inbox pages and inbox API requests, and it rejects inbox API requests that arrive on the public website’s hostname.
How the website is served
Pages are served over HTTPS with HTTP Strict Transport Security and a Content Security Policy that allows scripts only from this site and Cloudflare’s challenge service. Other headers block framing, MIME-type sniffing, and access to the camera, microphone, and location. The contact API rejects requests sent from other websites’ pages and requests above a fixed size.
What you can do
Keep passwords, access tokens, and confidential production data out of the form and out of email.
If you receive a confirmation email for an inquiry you did not send, ignore it. The address stays unconfirmed, and no project reply can be sent to it.
To ask for access to, correction of, or deletion of your inquiry and correspondence, email contact@sabersecurity.cloud. The privacy notice has the details.
What this page does not claim
This page makes no claim of security certification, compliance attestation, penetration-test results, or round-the-clock monitoring, for this website or for Saber Security.
Report a security issue
If you believe you have found a vulnerability in this website, email contact@sabersecurity.cloud with “Security report” in the subject line. Include the affected URL, the steps to reproduce it, and the impact you observed. Please do not access or change other people’s data, and do not run denial-of-service or high-volume automated tests against the contact form.
contact@sabersecurity.cloudQuestions
Do you store my IP address?
Not in the inquiry database. It stores a secret-keyed hash of your network address for abuse prevention, and rate limits count hashed values. Your address is sent to Cloudflare Turnstile to verify the security check, and Cloudflare, as the hosting provider, processes request data, including IP addresses, to deliver and secure the site.
Who can read my inquiry?
Inquiries are read in the private inbox, which requires sign-in through Cloudflare Access, and in a notification posted to a private Discord channel with your name, company, email address, chosen service, a message excerpt, and the draft reply. Cloudflare hosts the database, and Cloudflare Workers AI may process the inquiry to prepare that draft.
Does an AI write the replies?
Cloudflare Workers AI may prepare a first draft from your inquiry, within a daily limit. A person reviews every draft in the private inbox and can edit or reject it, and nothing is sent until that person approves it. Only the confirmation and receipt emails are sent automatically, without review.
Why do you ask me to confirm my email?
So that replies about a project go only to an address that its owner has confirmed. The link carries a random token that is stored only as a hash and expires after 24 hours, and confirming takes an explicit click. If you did not send the inquiry, ignore the email and the address stays unconfirmed.
How long is my inquiry kept?
Correspondence is retained as needed to manage the inquiry or engagement and to meet applicable obligations. You can ask for access to, correction of, or deletion of your inquiry and correspondence at any time by writing to contact@sabersecurity.cloud. The privacy notice describes your choices in more detail.