SpectraSecurity and data boundary
Know what is connected—and what is not.
This public website is intentionally separate from the Spectra application. It does not provide product authentication, tenant access or a route into customer jobs.
Request a private contact routeIn brief
The short version
The sample workspace uses fictional data. The five free tools run in the browser. The enquiry endpoint is a separate website service and can report success only after a dedicated database stores the submission.
Website boundary
No shared SaaS data or credentials.
The website repository and enquiry service are isolated from Spectra’s application repository. The website has no tenant session, Microsoft mailbox, accounting connection, product file store or application credential.
- Static HTML served through Cloudflare Workers Static Assets
- A noindex sample workspace with fictional records
- A dedicated Cloudflare D1 database for website enquiries only
Browser-local tools
Your worksheet values stay on the device.
Calculator, planner and brief-builder inputs are processed in the current browser tab. The tools do not upload artwork, job records or rates. Printing and downloads are created locally from the values you enter.
- No nesting or structural-engineering claim
- No market-rate or quotation guarantee
- Clear reset controls for shared devices
Enquiries
Success follows durable storage.
The form validates bounded fields in a Cloudflare Worker, uses a honeypot, rate limits hashed network addresses and deduplicates retries. An opaque receipt is returned only after the dedicated D1 database stores or finds the record. A notification email or CRM hand-off is not implied by that receipt.
- Responding to an enquiry and marketing permission are separate choices
- Ordinary Worker logs contain receipt and source state, not the submitted name, email or message
- Retention and rights are described in the privacy notice
Product roadmap
Planned means planned.
AI actions, Microsoft 365, Google Workspace, accounting connections, Leica capture and native mobile applications are not live capabilities of this website. Their security, permission and tenant controls must be verified in the application before the claims can expand.
| Area | Website state | Production proof still needed |
|---|---|---|
| AI actions | Planned concept | Authorisation, audit and human-review evidence |
| Business integrations | Planned or access dependent | Provider contract and tenant-isolation tests |
| Mobile | Separate delivery stream | Signed builds, privacy and device testing |
Public-site controls
Controls that can be inspected at the deployed origin.
The production Worker applies content-type, frame, referrer, permissions, opener and content-security policies; serves a true custom 404; keeps the sample workspace out of indexing; and enables structured logs and sampled traces. These are website controls, not evidence about the future SaaS application.
- HTTPS and custom domains managed by Cloudflare
- CSP with self-hosted scripts, styles and fonts
- No third-party audience analytics in the current release
- Dependency, build, crawl and browser checks in CI
Responsible reporting
Share a suspected issue privately.
Email karan@techgeekuk.com or use the published security.txt contact. Do not place exploit details, credentials, personal data or customer files in a general website form. No security certification, vulnerability-free guarantee or response-time promise is made.