Security

What this page covers

Every statement below describes the hollend.com website and is verifiable from the source code and the response headers this site serves. It does not describe Hollend’s internal business systems, and it is not a certification.

Transport

The site is served over HTTPS by GitHub Pages. TLS certificates are issued by Let’s Encrypt and renewed automatically by GitHub, and visitors who arrive over plain HTTP are redirected to HTTPS.

What this site stores

Nothing. The website is a set of static pages with no database, no server-side code and no credentials. The enquiry form does not submit anywhere: it opens your own email app addressed to info@hollend.com, and the message travels as a normal email.

How changes reach production

Changes are held in version control (Git) and published through GitHub Pages. Every change is recorded, so any update can be reviewed or rolled back.

Where information is held

This site is served by GitHub Pages in the United States, and is therefore subject to the laws of that country. The Privacy notice says what that means for you. Nothing personal is stored by the website itself.

Browser storage

One key, holding your own choice in the cookie settings panel. It stays in your browser, is never transmitted to us, and can be cleared from Cookie Settings in the footer. No advertising or analytics cookies are set and no third-party tracking scripts are loaded, which is why no cookie banner appears.

If something goes wrong

Where a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep a record of the breach.

Accessibility

The site targets WCAG 2.2 Level AA. Text and interface colours were measured against that standard rather than judged by eye: the brand teal is used for fills, and a darker derived tone carries any text, because the brand teal itself does not reach the required contrast on a light background. Contrast is re-checked automatically on every build. We have not yet commissioned an independent audit, and say so rather than imply certification.

Reporting a vulnerability

Email info@hollend.com with enough detail to reproduce the issue. Please give us a reasonable chance to fix it before disclosing it publicly. We do not currently run a paid bounty programme.