security posture
Six defensive layers between the internet and your data — documented in full, with nothing to install and nothing to take on faith. Every claim on this page can be independently verified, and the panel on the right is your own browser doing exactly that, right now.
requesting…
defence in depth
Security here isn't one wall — it's a sequence of independent ones. An attacker has to beat every layer below, in order, without tripping the monitoring that watches all of them.
All public traffic terminates at a hardened edge before it ever reaches our hardware. Plain HTTP is refused with a redirect, TLS 1.2 is the floor with 1.3 preferred, and traffic is re-encrypted — and the origin certificate re-verified — on the private leg to the server.
The web tier sends a strict Content Security Policy built on default-src none — nothing loads unless explicitly allowed, and no inline code exists anywhere on the site. HSTS instructs browsers to refuse insecure connections for two years. Version banners are suppressed.
Every application runs in an isolated Docker container joined only to the internal networks it needs. Nothing is published directly to the internet; the reverse proxy is the single doorway. Host firewalls default-deny all unsolicited traffic on both servers.
One identity provider fronts every application — there are no per-app passwords to leak. Access to the apps is granted by invitation, per person, and sign-in is by passkey: a device-bound credential unlocked with a fingerprint, face or PIN that never leaves your hardware. Enrolment and recovery flows carry bot-resistant challenges.
The two sites communicate exclusively across an encrypted WireGuard tunnel with cryptographic peer identity — no passwords, no exposed login surface, forward-secret session keys refreshed every few minutes. Management interfaces exist only on the tunnel and loopback.
The secondary site pulls encrypted backups from the primary nightly — a pull model, so the primary holds no credentials to the backup store and a compromised primary cannot reach its own backups. Backups travel over an encrypted link and are stored AES-256 encrypted in a repository the primary cannot reach. Both copies sit on servers we run — no third-party backup provider holds your data.
identity
Most breaches walk in through authentication. This platform's answer is to have exactly one authentication system — and make it uncompromising.
data & privacy
The honest answers to the questions that matter, stated plainly enough to be held against us.
threat model
No passwords anywhere in the login path — sign-in is by passkey, and the apps are invite-only. A leaked password list has nothing here to match against, because there is nothing to match.
The CSP forbids all inline code and every unlisted origin. A script that isn’t ours has nowhere to run.
frame-ancestors none — this site cannot be embedded inside another page, full stop.
HSTS with a two-year lifetime means browsers refuse plain-HTTP connections outright, even on first click of an old link.
The mesh has no login surface to attack and refreshes forward-secret keys every few minutes. Recorded traffic is worthless later.
Backups are pulled by the secondary. The primary holds no credentials to the backup store — it cannot delete or encrypt its own history.
verification
Three independent scanners audit this site live — each link opens a fresh scan on the scanner's own site. Then turn the same lens on your own connection:
Inspects every security header this site sends — the strict CSP, HSTS, frame and content-type protections.
Deep audit of the TLS configuration — protocol versions, cipher suites, certificate chain and known vulnerabilities.
Mozilla’s scanner, the strictest of the three on Content Security Policy and cross-origin protections.
The three scanners above audit this site. This one audits you — what your IP reveals, who your traffic is visible to, and whether you're on the network VPN or exposed.
Prefer the terminal? Inspect the security headers yourself:
curl -sI https://itzgee.com | grep -iE 'strict|security-policy|x-frame|x-content'
keep in the loop
There’s no public signup, and this isn’t one. Leave your name and email and you’ll get the occasional note when something on the network changes — an application going live, a security write-up, or word that access has opened. Nothing else, ever.
An occasional email when something on the network actually changes — an application going live, a security write-up, a change worth knowing about. No schedule, no newsletter, no noise.
Your name and email, nothing more. This is a mailing list, not an account: it grants no access to anything, and the applications stay invite-only and granted per person.
Access is provisioned per person and stays invitational today. If that ever changes, the people on this list hear first — nobody is added to anything automatically.
sent rarely · never shared · unsubscribe any time