The standard, and how to check it.

01 · This site

• Every connection to this site is encrypted, and browsers are told to insist on it for a year, subdomains included (HSTS).
• The page may run no code except its own and loads nothing from anyone else — not a font, not a script, not an image. A Content Security Policy enforces it, and forbids any other site from framing this one.
• No cookies, no trackers, no third-party requests. Nothing you do here is reported to anyone.
• If you choose light or dark, that choice is kept in your own browser and is never sent anywhere.
• The site is static files on a content-delivery network: there is no server of ours to break into and no database behind the pages.
• The fonts are served from here, under the SIL Open Font License.

02 · Our mail

• Mail from theclauditor.ai is signed (DKIM) and policed (SPF and DMARC), so a receiver can tell forged mail from ours.
• Other mail servers are given a published policy for delivering to us over encrypted connections (MTA-STS, in its testing phase) and asked to report any failure (TLS-RPT).

03 · Our domain

• Only the certificate authorities we name may issue certificates for our domain (CAA).
• Our DNS answers are signed, so they cannot be quietly swapped on the way to you (DNSSEC).

04 · If you find something

A security.txt file tells researchers where to report a problem, with a PGP key for the conversation and a written policy behind it — including a safe-harbor promise.

05 · The source is public

The source of this site — every page, the stylesheet, the fonts, the build and check scripts, and the scan that re-reads the live headers — is a public repository: github.com/The-Clauditor/theclauditor-ai. Commits are signed. On every change, and on a schedule, a public workflow rebuilds the site, checks it against the rules on this page, and scans the live site's headers, mail and DNS records; the log of each run is public.

A change in the repository does not deploy anything. The site is published by hand, by its owner, from a build whose checks have passed.

The assessment methodology itself is not in that repository. It stays private, available to a reviewer on request.

06 · The practitioner

CompTIA Security+ (ce) — earned June 2026, valid through June 2029. Verify it.

07 · Run your own scan

Run your own scan on my site and my mail: Security Headers · Mozilla HTTP Observatory · SSL Labs · MXToolbox — DMARC · MXToolbox — MTA-STS

The results are the scanners' own, not ours.

08 · What we don't claim

• No certification beyond the one above. No SOC 2, no ISO 27001 — a one-person practice doesn't carry them, and we won't pretend to.
• No guarantee. A clean scan today is a picture of today.
• No client names, no testimonials. The work we do for others is confidential, and it isn't marketing.
• No affiliation with Anthropic, whose Claude we use as a tool.