Legal
Security defaults
Fixed-scope pilots and modules, with least privilege and clear boundaries.
Priced security reviews live on the security services page. This page is how Harbor handles secrets, payments, and claims on the studio site and on build engagements.
Defaults we work from
- No secrets, API keys, or credentials in browser / client-side code
- Model keys and tool credentials stay server-side or gated
- HTTPS assumed for production handoff endpoints
- Where it matters, acceptance includes refusal and failure-path checks
This website
- Pages are served over HTTPS with a content security policy, HSTS, and related browser headers
- Cloudflare Web Analytics is on. There are no ad pixels, and fonts are self-hosted
- Card payments happen on Stripe. This origin does not collect card numbers
- Stripe webhooks are checked with a signing secret on the server. That secret is not in the public site
What we don’t claim
Fixed packages don’t include compliance certifications, penetration-test reports, or regulated-industry attestations. HIPAA/clinical work and regulated finance systems of record are outside what we take on. This page is not a penetration-test report.
Report an issue
If you think you’ve found a security issue on this site or in something we delivered, email [email protected] with details. See also Privacy and Terms. For a scoped engagement, see packages, security services, or contact the studio.
Want to see if a package fits?
Share what you’re trying to ship, your timing, and any constraints you already know. We’ll reply from [email protected].