Security & data handling
We tell clients that security and data protection are designed in, not bolted on. This page is where we show it on our own site. Everything below can be checked from outside — no certifications we don't hold, no promises you can't verify.
What this site collects: nothing
Visiting studio.ventures.eu sets no cookies — not analytics, not advertising, not "functional". There are no trackers, no analytics, no pixels, and no third-party scripts. You can confirm it in your browser's developer tools: the storage panel stays empty.
Because nothing is collected, there is nothing about you to leak, sell, or hand over. If we ever add analytics, it will load only after consent, and thecookie policy andprivacy policy will be updated before anything is set.
How the site is built
It's a static site. Every page is plain HTML generated ahead of time and served from a CDN. There is no database, no server-side code, no login, and no user accounts — so the usual ways a website leaks data don't exist here. The only JavaScript is a small scroll animation.
What the browser is told to enforce
These headers are live on every response. You can read them yourself withcurl -I https://studio.ventures.eu/, or any online header checker.
| Header | What it does for you |
|---|---|
| Strict-Transport-Security | Browsers may only reach this site over HTTPS, for a year, on every subdomain. |
| Content-Security-Policy | Restricts where scripts, styles, images and fonts may load from, and blocks plugins and framing outright. |
| X-Content-Type-Options | Stops the browser guessing a file's type and running it as something else. |
| X-Frame-Options / frame-ancestors | This site cannot be embedded in another page, so it can't be used for clickjacking. |
| Referrer-Policy | Other sites you click through to are not told which page you came from. |
| Permissions-Policy | Camera, microphone, location, payment and USB access are switched off. |
| Cross-Origin-Opener-Policy | Isolates this site from any window that opens it. |
No third-party origins
Our fonts are self-hosted and served from our own domain. Nothing on this site calls out to Google Fonts, a CDN we don't control, or an analytics endpoint — which means no third party learns your IP address because you read our website.
How changes reach this site
The source lives in a private repository. Nothing goes live by someone editing the server: every change is proposed as a pull request and has to pass automated checks first.
- Dependency audit. Any dependency that ships to your browser with a known high or critical vulnerability fails the build and blocks the change.
- Performance and accessibility budget. Every release is measured; scores below 95 on mobile block the change.
- Pinned build tools. Every step of our build pipeline is locked to an exact verified version, so a compromised third-party tool can't silently change what we ship.
- Weekly dependency updates. Security patches are raised automatically rather than waiting for someone to notice.
When you email us
Our only contact route is email, and we process what you send purely to reply to you. Details, including your rights under the GDPR, are in theprivacy policy.
This page is about this website
Client work is a different conversation. What we build and operate for you has its own architecture, hosting and data flows, and they're decided with you rather than described here. If you need a data processing agreement, a list of sub-processors, or specifics on where data sits for a particular project,ask us — that belongs to your engagement, not to a marketing page.
Found something we should fix?
If you spot a security issue on this site or anything we run, tell us and we'll look at it straight away.