Security

On Vercel’s platform, served over HTTPS only. Vercel also terminates connections and absorbs abusive traffic before it reaches the application.

Customer enquiry pages load no third-party scripts, fonts included; everything renders from first-party code. There is nothing on an enquiry page for anyone else to track through.

Setup details and completed enquiries live in one database created in an EU region, so that enquiry data is stored and primarily processed there. The provider is Neon, now a Databricks company, reached only over a TLS-encrypted connection. The region is pinned for the database itself; the provider’s supporting systems — control plane, backups, logs and vendor support access — are not confirmed to be limited to it, so any processing outside the EEA relies on the transfer safeguards in schedule 2 of the processor agreement.

Every public endpoint assumes it will be attacked, because any public form is. Enquiry submissions pass through several gates before anything is stored: per-IP limits of 10 requests a minute and 60 an hour counted in shared storage so they hold across all of our servers, a global daily budget across everyone, a separate daily cap per customer’s page, and a hard 16 KB ceiling on the size of any submission. The two smaller forms on our own site — the setup questionnaire after checkout, and the “set one up on my website” request — use the same shared counters at tighter limits and the same size ceiling.

Two quiet bot checks run alongside: a hidden field that people never see or fill in, and a minimum completion time — a “conversation” finished faster than a person can read the first question is dropped without a row being written. Unknown or switched-off pages answer exactly like each other, so there is no way to probe for what exists. These controls raise the cost of abuse substantially; no honest operator claims they make abuse impossible.

Secrets (payment keys, database credentials, mail credentials) live only in deployment environment configuration, never in code or repositories. The internal admin area sits behind HTTP basic authentication over HTTPS and fails closed: unconfigured, it stays locked rather than falling open.

The same fail-closed rule applies to every privileged route: the scheduled deletion job and the email-dispatch sweep answer “service unavailable” until they have been given a secret, and the delivery-status webhook accepts nothing unless its signature verifies. There are deliberately no customer accounts. A cleaning company never logs in, so there are no customer passwords to leak; their enquiries go straight to the mailbox they nominate.

Completed enquiries are stored only so they can be delivered reliably to the cleaning company concerned, and are deleted 30 days after delivery, with a hard ceiling of 90 days from receipt whatever their status. Deletion runs as scheduled code every day, not as intention.

Every stored item carries a unique event id, so a retried or repeated submission lands on the original record instead of storing — and later sending — an enquiry twice. A lead moves through a fixed sequence of states (captured, pending, sent or undeliverable) that can only move forwards, which is what stops a delayed retry from double-sending anything.

Enquiry emails are sent from linwick.co.uk by Resend, transactional delivery only, with replies addressed directly to the cleaning company. If a lead cannot be delivered, it is flagged and a human is told rather than it disappearing quietly.

The optional AI wording feature is switched off. It stays off until a lawful transfer mechanism exists for sending enquiry content outside the EEA, because that safeguard is not in place today — the same position, in detail, our privacy notice explains in section 5.

Failures are built to be visible: an enquiry that cannot be delivered is marked as such and escalates to a person, and payment failures alert us directly. If a personal data breach ever affects your data, we tell you without undue delay, as GDPR Article 33(2) requires of a processor — our working commitment, written into our processor agreement, is to tell an affected customer within 24 hours of becoming aware of a breach affecting their data.