Security Policy

We take the security of our website and your data seriously. This page explains how to report security issues and what to expect.

What's in scope

The following are covered by this policy:

  • The main website (aelia.love) — content, templates, and static assets
  • Booking integration — Acuity Scheduling embed and data flow
  • Donation processing — Stripe payment links and webhooks
  • Contact form — message submission and validation
  • Like buttons — thought post like counts stored in Cloudflare KV

Out of scope

The following are not covered (but we'll still forward reports):

  • Third-party services (Acuity, Stripe, Cloudflare) — governed by their own policies
  • Cloudflare infrastructure — underlying hosting, CDN, and DDoS protection
  • Social media / external links — content on platforms we don't control

How to report a security issue

If you discover a security vulnerability, please report it responsibly:

Email (preferred)

Send details to our security email. Include steps to reproduce, impact, and any proof of concept.

Report via email

Contact form

Use our contact form if email is unavailable. Mark the subject as "Security Issue".

Use contact form

Safe harbor / Authorized testing

We support responsible security research:

We will not take legal action against you for good-faith security research that follows this policy. This includes accessing only your own accounts, not accessing others' data, and not disrupting services. We ask that you give us reasonable time to fix issues before public disclosure.

What happens after you report

We commit to the following timeline:

Acknowledgment

Within 3 business days — we confirm receipt and assign a tracking ID.

Triage & validation

Within 10 business days — we assess severity and impact.

Resolution

We aim to fix critical issues within 30 days. Lower severity may take longer.

Coordinated disclosure

We'll agree on a disclosure date with you after a fix is deployed.

Third-party services

We use trusted providers for certain features. Their security practices are governed by their own policies:

Services we use

Stripe
Payment processing for donations. PCI DSS Level 1 certified. See Stripe Privacy.
Cloudflare
Hosting, CDN, DDoS protection, and KV storage for likes. See Cloudflare Privacy.
Google Fonts
Self-hosted web fonts. No external font servers are used.

We review third-party security practices annually and when adding new services.

Questions about this policy?

Reach out if anything is unclear:

Email us at {{ brand.email }} or use the contact form.

Email us