At a glance
The sample workspace uses fictional data. The five free tools run in the browser. The enquiry endpoint is a separate website service and can report success only after a dedicated database stores the submission.
01 / Data map
Three surfaces, three different boundaries.
The public website does not share tenant data or credentials with the Spectra application. The table describes the current public implementation, not a future SaaS architecture.
| Surface | Data handled | Current destination |
|---|---|---|
| Public pages | Page requests and operational security signals | Cloudflare delivery and security services |
| Free tools | Values typed into calculators, planners and builders | Current browser tab; local print or download |
| Sample workspace | Bundled fictional job records | Current browser; no customer account or persistence |
| Enquiry form | Contact details, message, permissions and technical deduplication fields | Dedicated website-only Cloudflare D1 database |
| Future SaaS | Potential tenant and job data | Not connected to this public website |
02 / Website boundary
No shared SaaS data or credentials.
The website repository and enquiry service are isolated from Spectra’s application repository. The website has no tenant session, Microsoft mailbox, accounting connection, product file store or application credential.
- Static HTML served through Cloudflare Workers Static Assets
- A noindex sample workspace with fictional records that reset
- A dedicated Cloudflare D1 database for website enquiries only
- No route from public pages into a customer tenant
03 / Browser-local tools
Your worksheet values stay on the device.
Calculator, planner and brief-builder inputs are processed in the current browser tab. The tools do not upload artwork, job records or rates. Printing and downloads are created locally from the values you enter.
- No nesting or structural-engineering claim
- No market-rate or quotation guarantee
- Clear reset controls for shared devices
04 / Enquiries
Success follows durable storage.
The form validates bounded fields in a Cloudflare Worker, uses a honeypot, rate limits hashed network addresses and deduplicates retries. An opaque receipt is returned only after the dedicated D1 database stores or finds the record. A notification email, human review, resource fulfilment or CRM hand-off is not implied by that receipt.
- Responding to an enquiry and optional marketing permission are separate choices
- Ordinary Worker logs contain receipt and source state, not the submitted name, email or message
- The website database automatically deletes enquiry records after 24 months; shorter-lived rate-limit records are periodically cleared
- Rights, processor and international-processing information is in the privacy notice
05 / Product roadmap
Planned means planned.
AI actions, Microsoft 365, Google Workspace, accounting connections, Leica capture and native mobile applications are not live capabilities of this website. Their security, permission and tenant controls must be verified in the application before the claims can expand.
| Area | Website state | Production proof still needed |
|---|---|---|
| AI actions | Planned concept | Authorisation, audit and human-review evidence |
| Business integrations | Planned or access dependent | Provider contract and tenant-isolation tests |
| Mobile | Separate delivery stream | Signed builds, privacy and device testing |
06 / Public-site controls
Controls that can be inspected at the deployed origin.
The production Worker applies content-type, frame, referrer, permissions, opener and content-security policies; serves a true custom 404; keeps the sample workspace out of indexing; and enables structured operational logs. These are website controls, not evidence about the future SaaS application.
- HTTPS and custom domains managed by Cloudflare
- CSP with self-hosted scripts, styles and fonts
- No third-party audience analytics script in the current release
- Dated dependency, build, crawl and browser checks
- No claim of penetration testing, separate product certification or complete vulnerability absence
07 / Responsible reporting
Share a suspected issue privately.
Email karan@techgeekuk.com or use the published security.txt contact. Do not place exploit details, credentials, personal data or customer files in a general website form. No security certification, vulnerability-free guarantee or response-time promise is made.