Security.

Encrypted connections

Every page of bldwell.com is served over HTTPS, so what you send us is encrypted on its way. Browsers are told to use only HTTPS for our domain for two years, so they don't fall back to an unencrypted connection.

What runs in your browser

Our pages load no advertising, tracking or social media scripts, and our fonts come from our own site. A strict content security policy lets your browser run code only from bldwell.com. The one exception is Cloudflare Turnstile on the booking page, which checks that a person, not a bot, is booking a call.

Other sites can't show our pages inside theirs, and our pages can't use your camera, microphone or location.

How we keep your information

• Handled by our server. What you type into our forms goes to our server, never to outside scripts in your browser. The server checks it before anything is saved.
• Locked down at the source. Our database encrypts what it stores. Every table is closed to the database's public access, and only our server, with its private key, can read or write it.
• No secrets in code. Keys and passwords live in our hosting provider's encrypted secret storage, never in our code.
• Quiet logs. Our logs record what happened as short codes, not your name, email or phone number.

What we collect and why is in our Privacy policy.

Who can get in

• Invited people only. Our admin is open only to people we've added to the team. Anyone else is signed out.
• One-time codes. Each person signs in to their own account with a 6-digit code emailed to them. A code works for 10 minutes and stops after 5 wrong tries, we store only a scrambled copy of it, and how often codes can be sent is limited.
• Only what the role needs. Each person sees and does only what their role allows. A salesperson, for example, sees only their own prospects and the unassigned ones.
• Access ends with the role. Removing someone from the team ends their access, and any connection they gave an AI assistant to our admin stops working.

Spam and abuse

The booking form is protected by Cloudflare Turnstile and a hidden field that only bots fill in, and a booking is checked again on our server before it reaches our calendar. Each person can hold one upcoming call at a time.

Providers we rely on

We run on established providers, each with its own security program, and give each one only the access its job needs:

• Cloudflare: hosting, our domain and the booking page's spam check;
• Supabase: our database;
• HighLevel (LeadConnector): our CRM, booking calendar, and email and text delivery;
• Google Workspace: business email, calendars and video calls;
• Resend: email delivery;
• Stripe: card payments. We never see or store your full card number.

The security of the systems we build for clients is set out in each client's signed agreement.

Reporting a security problem

If you think you've found a security problem with bldwell.com, email hello@bldwell.com with what you found and how to reproduce it. While you look into it, please:

• don't access, change or delete other people's information;
• don't slow down or disrupt the site, and don't send spam through its forms;
• give us a reasonable time to fix the problem before telling anyone else.

We look into every report and will reply to you.

Contact us

Security questions: hello@bldwell.com. YDR LLC, doing business as BLDWELL.