Trust center How I handle your data

In short: Coropos is one person. Your site lives with a third-party host, I keep my own copies of the source, my accounts use strong passwords and two-factor login, and nobody else has access. I hold no certifications and promise no uptime figure. If you find a security problem, email me.

1. Who runs this

Coropos Web Services is my business name; when I say I, I mean Edward Quigley.

Coropos Web Services is a New Hampshire DBA (Business ID 918731) that I run alone, as paid independent work alongside a full-time technology job. There is no staff, no contractors and no outsourcing. Every message to Coropos is read by me, every site is built by me, and every account that holds your data is one I hold personally. The number of people who can see your data is one.

2. Where sites are hosted

Client sites I host run on a hosting account I rent from Cybrancee, a hosting provider in the United States. Cybrancee owns and runs the servers, the network, the firewalls, the TLS certificates and the server-level backups. I run the account: the files, the databases, the DNS, the email setup and who can log in. This website is hosted separately from client sites on my own account.

What that means: I can tell you how your site is set up and fix anything at the site level, but I cannot see inside the host's infrastructure, I cannot promise what the host does not promise, and if the host has an outage your site has an outage. If you prefer, I can build your site on a host of your choosing under your own account.

3. What this website collects

Very little. The contact form takes your name, email and message and emails them to me; the form is protected by Google reCAPTCHA. Google Analytics runs only if you accept analytics cookies, and the chat widget loads only if you accept functional cookies. The cookie banner stores your choice in a cookie for a year and checks your country once with ipapi.co. The newsletter form on the contact page is run by Brevo. Nothing is sold on this site and there are no advertising cookies. The privacy policy gives the full picture and the cookie policy lists every cookie.

4. Payments

I send an invoice and you pay it. I do not take payments through this website and I never see, handle or store full card numbers; the payment method is described on the invoice itself. What I keep is the invoice and the record that it was paid, for the seven years that tax law requires.

5. Backups and access

Two layers of backup. The host keeps its own rolling backups of the hosting account. Separately, I keep the source files for every site I build, on my own computer and on a backup drive, so a site can be rebuilt even if the hosting account were lost. If you want a copy of your site at any time, ask and I will send it.

Access is simple because there is only me. Every account that touches your data, including the hosting control panel, the registrar, my email and the client dashboard, has a long unique password kept in a password manager and two-factor login turned on wherever the service offers it. I do not share logins. When a project ends, you get your credentials and I remove mine if you ask.

If I learn of a breach affecting your data I will tell you promptly, and within any period the law requires.

6. What I don't claim

Plainly, so there is no confusion:

  • I hold no security or compliance certification: no SOC 2, no ISO 27001, no HIPAA attestation, no PCI DSS assessment. Some of the services I use hold their own; that is theirs, not mine.
  • I give no uptime guarantee and no percentage. The hosting and support terms says what I do promise.
  • There is no round-the-clock monitoring. I check on things when I am working, and the host alerts me to some problems.
  • I am one person with a day job. I reply to everything, but not instantly.

If your project needs any of those, I will say so at the start and help you find someone who can provide it.

7. Reporting a security problem

If you find a vulnerability in this website, in a site I host, or in a service I run, email info@coroposws.com. Include the address where you found it, what the problem is, steps to reproduce it, and what you think it could allow. I reply as soon as I can, normally within two business days, and I will tell you what I did about it.

Please stop at proof of concept: do not read, change or delete data that is not yours, do not disrupt a site, and give me a reasonable time to fix the problem before telling anyone else. I will not pursue someone who reports in good faith and stays within those limits.

8. All policies

Everything I have written down about how I work, in one list. The policy center has the same list with a short note on each.

Questions about this document: info@coroposws.com. Coropos Web Services is the independent web studio of Edward Quigley, a New Hampshire DBA (Business ID 918731).