Security

Last updated: August 11, 2026

We build systems for other people's businesses, so it would be strange to run a careless website. This page describes how taqi.io is actually built and how to reach us about a security problem.

Reporting a vulnerability

We do not currently run a paid bug bounty, so we cannot offer a reward. We will not pursue legal action against researchers who report issues in good faith, act in a way that respects the privacy of others, avoid degrading our services, and do not access or modify data that is not their own. Please do not run automated scanning that generates significant traffic, and do not attempt social engineering, physical attacks, or denial of service.

A machine-readable version of this contact information is published at /.well-known/security.txt.

How this site is built

This is a static website. There is no application server, no database, and no user accounts. That eliminates entire categories of risk rather than mitigating them, which is the point.

• Our own JavaScript is deliberately small. The pages we author are hand-written HTML and CSS, with one same-origin script that opens and closes the mobile navigation. The third-party chat widget is described below. We add no analytics tags, tag managers, or advertising pixels of our own.
• HTTPS only. All traffic is served over TLS. HTTP requests are redirected, and we send HTTP Strict Transport Security so browsers refuse to downgrade.
• Content Security Policy. A CSP restricts what can run and load. Script is limited to our own origin and the chat widget's origin; inline and other third-party script is blocked, and framing the site is forbidden.
• Hardened response headers. Including X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cross-origin isolation headers.
• No build pipeline. The site is hand-written with no package manager and no build chain, so our own code has no dependency supply-chain to compromise.

The chat widget

We want to be straight about the one exception to the above. This site embeds an AI chat widget from YouEx.ai. It is third-party JavaScript loaded from engage.youex.ai, and it is the reason a few of the guarantees a purely static site could make no longer hold:

• It runs third-party script in your browser, which we allow through the CSP for its origin only.
• It contacts YouEx.ai (and Google Fonts) as you browse, sets an identifying cookie, and sends usage and chat data to YouEx.ai.
• As third-party code, it is a supply-chain dependency: we are trusting YouEx.ai's own security.

We accept that trade-off so we can answer questions quickly, and we constrain it as tightly as the widget allows. What it collects and how to avoid it is spelled out in our Privacy Policy. If you would rather not run it, blocking cookies or scripts for this site disables it without affecting the rest of the page.

Data we hold from this site

Two things generate personal data here: email you send us (the "Contact" links open your mail client), which lands in our Google Workspace inbox, and the chat widget, which sends data to YouEx.ai as described in our Privacy Policy. Nothing is sold or shared for advertising.

Infrastructure

The site is hosted by Netlify, our email runs on Google Workspace, and the chat widget is operated by YouEx.ai. Each is responsible for the security of its own platform under its respective terms. Access to our hosting and domain accounts is limited to people who need it and protected by multi-factor authentication.

What this page is not

We want to be straight with you: this page describes the security of this website. It is not a certification, an audit report, or a compliance attestation, and we do not claim to hold one. If you are evaluating Taqi for an engagement and need to discuss how we would handle security within your environment, including your own compliance requirements, that is a conversation we are glad to have. Start it at hello@taqi.io.