Security
A static, minimal, privacy-first website with a reduced attack surface.
Static website architecture
This website is built as a collection of static HTML, CSS, and JavaScript files. There is no server-side application processing requests, no database, no user accounts, and no session management.
Static architecture eliminates entire categories of server-side vulnerabilities including SQL injection, session hijacking, and server-side code execution attacks.
No user accounts or login system
There is no user registration, login, or authentication system on this website. There are no passwords to compromise and no user accounts to protect.
Minimal data collection
This website collects no data on page load. The dataset request form uses a mailto link to open your email client — no information is submitted to or stored on a web server controlled by this website.
Because we collect minimal data, there is minimal data to protect or to lose.
No tracking scripts or third-party code
There are no analytics scripts, advertising pixels, social media embeds, or third-party JavaScript libraries loaded from external servers. This eliminates the attack surface associated with third-party supply chain vulnerabilities.
Dataset request handling
Dataset requests submitted through the form are received as email messages. Requests are reviewed manually before any project begins.
Requests are handled with discretion. We do not share request details with third parties.
Each dataset project is scoped and reviewed before work begins. We evaluate sources, scope, legal considerations, and feasibility on a project-by-project basis.
No implied certifications
We do not claim enterprise security certifications, compliance frameworks, or third-party audits unless specifically documented. This page describes our actual practices, not aspirational standards.
Reporting a concern
If you identify a security issue with this website, contact us through the Contact page.