Security

How this website is built and how to reach us if you find a problem with it.

Scope. This page describes www.getfluere.com — the marketing site you are reading. Fluere CRM and Fluere Expense are separate applications that have not launched. We are not going to describe their security posture before they exist; each will publish its own when it ships.

What this website holds

Very little, by design. There are no accounts, no login, and no database. Nothing you do here is stored on our servers.

The single exception is the contact form. What you type is passed to our email provider and delivered to us as a message. It is not written to a database, not used for advertising, and not sold. See the privacy policy for the detail.

How it is built

Served only over HTTPS, with HSTS instructing browsers never to attempt an unencrypted connection.
A Content Security Policy that blocks framing entirely, so the site cannot be embedded and used for clickjacking, and restricts where scripts, styles and images may come from.
Pages are static files. There is no server-side rendering to attack and no query layer to inject into.
The one server route — the contact form — validates every field, caps input length, and is rate limited at the network edge.
Credentials live only in environment variables on the host. No key is present in anything sent to your browser, and this is verified against the built output rather than assumed.
Dependencies are kept deliberately few. Four production packages, reviewed before addition.

We hold no security certifications. We are a small company and have not been through SOC 2 or ISO 27001. Saying so plainly seems better than letting a list of practices imply an audit that has not happened.

Reporting a vulnerability

If you have found something, email info@wilcoxstrategy.com with "Security" in the subject. Please include what you found, the steps to reproduce it, and what an attacker could do with it.

We will acknowledge your report within five business days. We do not currently run a paid bug bounty, and we will not pretend otherwise — but we will credit you if you would like to be credited, and we will tell you when it is fixed.

Please give us reasonable time to fix an issue before publishing it, and please do not run automated scans that degrade the site for other people, access data that is not yours, or test anything on a real customer's account.