Security, explained clearly.

Access follows the purpose

• Editorial pages and saved draft previews require an authenticated account with an editor or administrator role.
• Supabase row-level policies separate released articles from private drafts and restrict post and image management to authorized editors.
• Contact and meeting-request records cannot be read directly by public or editorial browser accounts. They are handled through trusted server operations and company database administration.
• The privileged database key stays in the server environment and is not placed in public browser variables.

Forms and uploaded content

The server validates enquiry fields, message size and notice acknowledgement. The web API rejects browser requests from a different origin and requires JSON for form submissions. Honeypot handling and a basic process-local request limit provide additional abuse controls.

Article content is rendered as text rather than executable HTML. Blog image uploads are limited by type, size and editor permissions. Blog media is public content and should not contain confidential material.

Browser protections

Response headers reduce MIME-sniffing, framing and referrer exposure. Content Security Policy directives restrict embedded objects, base-URL changes and form destinations. Permissions Policy disables camera, microphone, geolocation, payment and USB access for this site.

The local development site uses HTTP on loopback. A public deployment must provide HTTPS through its hosting platform. HSTS is enabled in the application configuration when its canonical public origin is HTTPS.

Keep routine browsing self-contained

Fonts are hosted with the website, so loading them does not require a request from a visitor’s browser to Google Fonts. Maps open only through a link. An optional third-party booking calendar is loaded only after a visitor chooses to load it.

The contact and meeting forms do not send enquiry messages to an AI model or publish them as website content.

Scope and deployment responsibilities

This page describes application controls present in the source and local setup. It is not a penetration-test report, security certification or guarantee of complete GDPR compliance.

Production hosting, database region, processor arrangements, backups, retention, monitoring and operational access must be configured and reviewed for the actual deployment. The process-local rate limit is a basic measure, not a substitute for production traffic protection.

For personal-data processing and your rights, read the privacy notice. Each separate Berrinex product has its own operational and privacy context.

Report a security concern

Email office@berrinex.com with “Website security report” in the subject. Include the affected URL, a concise description, and steps or evidence that help us understand the issue.

Please avoid including passwords, live access tokens, customer records or other unnecessary personal data. Do not access other people’s information or disrupt the service while investigating a concern.