Privacy

This site is built the way we would ask a client to build one, so this page can be specific rather than general. Every statement below describes how the site and its mail are actually handled.

Effective 2026-10-15. The date changes when this policy changes.

What changed on 2026-10-15: the site now counts page views with GoatCounter, an open-source counter that runs on this site’s own server. It sets no cookie, keeps no IP address and records no location, counts nothing from a browser that sends Do Not Track or Global Privacy Control, and can be switched off for your browser with one button (Page counts). This adds two scripts served from this site: /analytics.js, which decides whether a page view is counted, and GoatCounter’s /count.js, which it loads only when one is. Separately, the page-view totals worked out from the access log are now kept as daily totals for 13 months (What the website records), and the search figures Google and Bing report to us about this site are described for the first time (What search engines tell us).

What changed on 2026-10-14: a contact-form submission sent without the contact page’s script — no signed ticket and no description of your browser, which is how almost all automated spam arrives — is now held for review on the server instead of being emailed to us straight away. Before, it was emailed unless other signals added up. A person still reads it, and a genuine enquiry is released and answered (If you use the contact form).

What changed on 2026-10-01: we now say what the access log is used for, and it carries one new field, a coarse crawler label (What the website records). The sentence about the user-agent string now names the four sites it applies to and says that other services on the same server are not covered, error logging is set to critical faults on all four, and the retention of their access and error logs is stated as up to 15 days, which is what the server does.

What changed on 2026-09-27: the previous version of this page said the web server kept no copy of a contact-form submission at all, and that the site ran one script. Both have changed, so that automated spam can be told from real enquiries. The server now keeps a short technical record of every submission, and keyed fingerprints used to limit repeated sending (If you use the contact form). A submission that looks automated is held on the server in full — your name, email address, organization, document type, deadline and message — until a person reviews it, and a short excerpt of it is included in a daily reminder emailed to us (same section). A second script, /contact.js, now runs on the contact page: it stores a session identifier in your browser, fetches a signed ticket, solves a small puzzle and sends a short description of your browser with the form (Cookies, and why there is no banner). While scoring a submission the server may make two public DNS lookups about your email domain and network address. Our own mail server now also keeps a copy of each email it sends from a sechb.com address, the emailed enquiries and daily reminders among them, for ninety days. The server’s own log now records the outcome of each submission in more detail, and the access log does not record anything after the ? in the one address the contact page fetches its ticket from. We now also keep an internal log of the enquiries that become leads, with the quotes we send on them; what it holds and when it is deleted are stated under If you use the contact form.

Who is responsible

British Columbia’s Personal Information Protection Act requires an organization to designate one or more individuals responsible for its compliance, and to make that person’s position and contact information available to the public (s. 4(3) and s. 4(5)). That is the purpose of this section.

Position: Principal, SecHB.
How to reach that person: the contact form, which goes to a monitored mailbox. Say in the first line that it is a privacy request, so it is not read as a sales enquiry.

The Act asks for a position and a route, not a personal name or a postal address. Both are given above. If you would rather not use a web form for a privacy request, say so in it and a direct address will be sent back to you.

What the website records

The web server writes one line per request, containing exactly these fields:

• Your IP address with the final part removed — the last octet for IPv4, everything after the first three groups for IPv6. What is stored identifies a network, not a visitor. Anything that does not match either pattern is logged as 0.0.0.0 instead.
• The date and time of the request.
• The page or file requested, and the HTTP method and version. The address is logged as your browser sent it, including anything after a ? in it — with two exceptions: for /contact-token, the address the contact page fetches its signed ticket from, only the path is logged, because the page puts its session identifier (described below) after the ? there; and for /stats/count, the address the page counter reports to (Page counts), only the path is logged, because the page’s address, its title, the referring page and your screen width are carried after the ? there.
• The response status code and the number of bytes sent.
• The referring page, if your browser sent one. Links leaving this site send no referrer, because the site sets Referrer-Policy: no-referrer.
• A coarse crawler label, last on the line: one word such as googlebot, gptbot or other-bot when your browser identifies itself as a known search or AI crawler, another automated client or a common HTTP library (curl, wget, python-requests and the like), or sends no user-agent at all; and a dash for everything else. The server works the label out from the user-agent string and writes only the label.

Purpose. We use the access log for security and troubleshooting. We also count page views in aggregate — per page, section, referring site and campaign tag (utm_source and utm_medium), and visits by crawler — to see which pages are read, and how many contact-form submissions were accepted (the log shows that one was, never what it said). The counts are worked out from this log alone, with no cookies, no scripts and no third party. They profile no visitor. The counts are kept as daily totals for 13 months, so trends can be compared after the logs themselves have been deleted. A daily total holds only numbers: views per page, per referring category (and, for AI assistants, the assistant’s name), and requests per crawler label. It holds no address, no identifier and no user-agent, and it cannot be traced to a visitor. Totals older than 13 months are deleted from our live systems. These log counts are separate from the page counts a script makes, described under Page counts.

Your browser’s user-agent string is deliberately not logged by sechb.com, mail.sechb.com, wiki.sechb.com and admin.sechb.com — the access log keeps only the crawler label above, and the contact-form record below keeps a one-word browser family, never the string itself. The page counter reads the string to name your browser and operating system and does not keep it, with the one short-lived exception for automated requests stated under Page counts. Other services run on the same server, including dxvpn.sechb.com, which is a separate service; they keep their own logs, which may include full addresses and user-agents, and this notice does not cover them. For these four sites, server error logging is set to report only critical faults, because nginx cannot be told to shorten IP addresses in that log: a line in it holds the full address.

Retention: the access and error logs of these four sites are rotated daily, including on a day nothing was written, and the current day’s log plus at most fourteen rotated days are kept, so a request is deleted after at most 15 days (give or take the hour the nightly rotation can start late), and sometimes sooner, because the server also rotates early when its disk runs low. Nothing is archived beyond that, and no copy of these logs is kept elsewhere. The rotation is configured on the server to match this sentence — if the two ever disagree, the server is what is true, and this page is the defect. The aggregate daily totals described above are the only thing kept longer, for 13 months.

If you use the contact form, its record (described below) also holds your shortened network address and the time you sent it. Because the access log holds the same two things, the two could be lined up for as long as both exist, to see which pages someone on your network read before writing. That is a property of what is kept, so it is stated here rather than denied.

Page counts

To see which pages are read and how readers arrive, the site counts page views with GoatCounter, open-source counting software that we run ourselves, on the same server as this site. No other company runs it or receives anything from it, and only we can see its figures, behind the same login as our other internal pages. It sets no cookie and stores nothing in your browser. It is not used to identify, locate or profile anyone.

When a page view is counted. Every page loads /analytics.js, a short script of ours, except the page shown for an address that does not exist and the two pages shown after you send the contact form (the thank-you and the error page). It counts nothing, and loads nothing more, if any of these is true: your browser sends a Do Not Track or Global Privacy Control signal; you have opted out with the button below; your browser does not let this site store anything, so an opt-out could not be remembered; or your browser reports that automation software is driving it. Otherwise it loads /count.js, GoatCounter’s own script, unmodified and served from this site, which sends one request about the page view to /stats/count on this site. With scripting switched off, nothing is counted.

What that request carries. The page’s address and title; the address of the page that linked to it, as your browser reports it (usually only the other site’s name); the part of the page’s address after a ?, which is where campaign tags such as utm_source and utm_campaign are carried; your screen’s width; and a flag if your browser reports automation. Like every request, it also carries your IP address, your browser’s user-agent string and the languages your browser asks for.

What our server passes on. The server does not hand that request to GoatCounter as it came. If your browser sends Do Not Track or Global Privacy Control, the server answers the request itself and nothing reaches the counter. Otherwise it passes on only the page’s address, and only when that address is a page of this site (for anything else, nothing reaches the counter); the page’s title as this site names it, never the one the request carried; the referring address, if it is no longer than 1,024 characters; and the automation flag. The part of the page’s address after a ? and your screen’s width are dropped there, so GoatCounter reads no campaign tag and never sees the width. Your IP address, user-agent string and languages still reach it, as they reach any web server.

What is kept. Counts, and the names they are counts of: for each page, the number of views and of visits in each hour; and for each page and day, the number of views from each referring address (without its http://, and with the search engines grouped under their names), each browser name and version, and each operating-system name and version, the last two worked out from the user-agent string. GoatCounter is set not to keep a record of each page view; there is no row about you, only totals. The names go with the counts: once no count still kept refers to a page, a referring address, a browser or an operating system, its name is deleted too, within a day — except the most recently added name of each kind, which stays until a newer one has been counted, so that a name in use at that moment is never removed.

What is not kept. Your IP address and your user-agent string are not stored, apart from the two short-lived exceptions below. Your screen width is sent by GoatCounter’s script and dropped by our server before it reaches the counter. Your location is not recorded: GoatCounter carries a country database, and it is switched off for this site, country and region alike. Your browser’s languages are not recorded either. The address the counter reports to is written in the access log without anything after its ?.

Visits, and the eight hours. To count a reload or a return to the same page as one visit rather than several, GoatCounter keeps a table in the server’s memory that links your IP address and user-agent string to a random number, and records which pages of this site that browser has viewed, for eight hours after your last page view, and then forgets it. The random number and the list of pages are used only to tell a first view of a page from a repeat; the number is never sent to your browser and does not follow you to any other site. The service is not allowed to move that memory to disk. Two exceptions, stated because the software does them:

• When the counting service stops — for an update or a restart — GoatCounter writes that memory table into its database so that it can carry on where it stopped: the IP addresses, the user-agent strings and, for each, the list of pages viewed in those eight hours. Our server deletes that entry, and overwrites the space it took, as soon as the service has stopped, and deletes it again before the service starts, so a return after a restart is counted as a new visit.
• A request GoatCounter recognizes as automated, such as a search-engine crawler, is not counted. GoatCounter files it in a separate table with the page’s address, the time, a code for the kind of automation and the user-agent string. Our server empties that table every hour.

How long. The counts are deleted after 13 months, by GoatCounter’s own data-retention setting, and their names with them, as stated above. The visit table lives for eight hours in memory, and the automated requests for at most about an hour. Every period in this section is the time after which something is deleted from our live systems.

Flooding. The server limits how many requests one IP address can send to /stats/count in a minute, as it does for the contact form; for an IPv6 address the limit applies to its network (the first four of its eight groups), because one connection is usually given a whole range of addresses. The address, or that network part, is held in the server’s memory for that, and is never written down.

Opting out. The button below stops this browser being counted on every page of this site. It saves one item in your browser’s local storage, under the name skipgc, holding the single letter t; that is the name GoatCounter’s own script also checks before it counts anything. Pressing the button again removes it. Clearing this site’s data removes it too, and counting then resumes. Nothing is stored unless you press the button. The button needs scripting; with scripting switched off, nothing is counted anyway.

What search engines tell us

Google Search Console and Bing Webmaster Tools report to us how this site appears in their search results, and our server fetches those reports once a day into a small database of its own. It holds, for each day, each search and each page of this site: how many times the page was shown in results, how many times it was clicked, and its average position. The search is the words people typed into the search engine, as the search engine reports them, so it can contain whatever a searcher typed, which may be personal. Nothing in it identifies who searched: no address, no account, no identifier of any kind; the search engines send only these totals. Only we can see it, behind the same login as our other internal pages. Each day’s figures are deleted from our live systems after 16 months, the period Search Console itself keeps.

Cookies, and why there is no banner

This site sets no cookies, loads no advertising or social pixels, and no third-party scripts. There are no web fonts or images fetched from another domain, so loading a page here contacts nobody but this server. The only scripts are four files served from this site: /theme.js, which runs the light/dark button; /analytics.js, which decides whether a page view is counted; /count.js, GoatCounter’s counting script, which /analytics.js loads only when a page view is counted (Page counts); and /contact.js, which loads on the contact page alone and helps the server tell genuine enquiries from automated ones. Those four are the only scripts this site serves. The Content-Security-Policy every page is served with is, in full, default-src 'none'; script-src 'self'; connect-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'. It forbids any inline or remote script, and allows no request to any other server. The contact form is plain HTML and can be sent with scripting switched off, but a submission sent without the contact page’s script is held for review before it reaches us (If you use the contact form).

Three things can be stored in your browser by this site, and none is a cookie. The first is the page-count opt-out described above: skipgc in local storage, holding t, saved only when you press that button. It stays on your device and is never sent to this server. The other two follow.

If you press the light/dark button, your choice is saved in your browser’s local storage under the name sechb-theme, holding the single word light or dark. The theme choice stays on your device, is never sent to this server, and is linked to nothing else. Clearing this site’s data removes it. If you never press the button, no theme choice is stored.

On the contact page, /contact.js does four further things, and this is all of them. It stores one identifier in your browser’s session storage under the name sechb-contact-sid: a random 22-character value that this server issues the first time the page asks for a ticket. It is written automatically when the contact page loads, without your pressing anything. Session storage belongs to that one browser tab and this site; no other page reads it, and your browser deletes it when you close the tab. The page sends it back to one address only, /contact-token, and the signed ticket that comes back carries it, so it reaches the server with your message. It exists for one purpose: to limit how many messages one tab can send (a few in an hour), which is why the server keeps a keyed fingerprint of it for thirty days. It asks this server for a short-lived signed ticket when the page loads, and spends about a second of your processor in the background solving a small puzzle attached to it; the answer is submitted with the form and is what makes bulk automated submission expensive. And when you press send, it fills one hidden field with a short description of the browser you are using: your timezone and local hour, how long the form had been open, the language your browser reports, whether your screen is a phone, a tablet or a desktop, and whether your browser reports that it is being driven by automation software. And it adds one more empty field to the form, alongside the one already in the page, under a name that changes from day to day; like the first it is hidden from you and from a screen reader, and a submission that fills it in was not written by a person. None of that is read on any other page, and nothing about it is sent anywhere but back to this server.

Do Not Track and Global Privacy Control

Both signals are honoured. When your browser sends either one, /analytics.js does not load the page counter and nothing about your visit is sent to it (Page counts). The access log described above still records each request, as it does for every visitor, because it is how the site is served, secured and fixed; it follows no one from site to site. No other party collects information about your activity on this site, because no other party is contacted.

Where this is hosted

The server that runs this site and our mail is in the United States. If you are reading this from Canada, the United Kingdom or the European Union, the request data described above is processed in the United States, and US authorities can compel disclosure of data held there under US law. That is a real consideration and it is stated here rather than buried.

If you use the contact form

The form on the contact page collects your name, your email address, and your message; organization, document type and deadline are optional and blank unless you fill them in. It also carries hidden fields that a person never sees or completes: two that must stay empty and catch automated submissions — one in the page, one added by the script — one holding the signed ticket described above, and one holding the short description of your browser described above.

A form on a public site receives far more automated spam than genuine enquiries. To stop real messages being buried, the server scores each submission against a list of technical signals before it decides what to do with it. Most submissions score low and are emailed straight away. One with several signs of automation is emailed too, with the reasons attached, so a person can judge it. One with strong signs of automation is held on the server instead of being emailed in full, and we are told something is waiting; if it turns out to be a genuine enquiry we release it and answer you, and its content is deleted from the server at that moment. A submission sent without the contact page’s script — no signed ticket and no description of your browser, which is how almost all automated spam reaches a form — is held this way, so if you send the form with scripting switched off, a person reads it on the server before it reaches us.

We are told through a daily reminder email sent by the server to the same enquiries mailbox the form uses. For each submission being held, it carries a short reference, when it arrived, its score, each signal that fired, the domain of the email address, the country, the shortened network address and the first 120 characters of the message — enough to recognize a genuine enquiry, not the whole of it, and not what you typed into the name or email fields. It repeats in every day’s reminder until the submission is released, deleted, or reaches its deletion date, except that a reminder quotes at most forty held submissions: when more are held at once, the rest are only counted. The same email lists up to fifty flagged submissions of the past day by reference, arrival time, score, email domain and country, without its content. A flagged submission is emailed to us in full when it arrives unless that email fails, in which case you are shown an error page; one that was held and later rescored as flagged stays held and is quoted as above. These reminders are mailbox copies: each is deleted from the mailbox by hand once every held submission it quotes has been released, deleted or reached its deletion date.

What happens to a submission, precisely:

• It is posted to this site’s own server. No third-party form service, spam service or CAPTCHA provider is involved, and no part of the page contacts anyone but this server.
• The server turns it into an email and sends it to SecHB’s enquiries mailbox. The email address you give is used as the reply address, so that answering you does not require copying it anywhere else. Our own mail server, on the same host, also files a copy of every message it sends from a sechb.com address — the emailed enquiry and each daily reminder among them — in an outgoing archive that deletes each copy automatically after ninety days.
• While it scores the submission the server may ask the public domain name system two questions: whether the domain of your email address accepts mail at all, and what name your network address resolves back to. Those go to a resolver, not to a company — nothing about your message or your identity is sent, and the answer to the second is used and discarded.
• The server’s own log records whether each submission was accepted or refused and why, the spam band and score and a short reference for accepted ones, and, for a submission refused by the rate limit, a short keyed fingerprint of the network or the browser session that reached the limit. It never records your name, your email address or its domain, your message, your network address, or the session identifier itself. Whoever holds the key could work out which network a network fingerprint came from by trying every network in turn; a session fingerprint cannot practically be traced back. This log has no fixed retention period: the system rotates it by size, which in practice can keep an entry for some months, and a deletion request does not reach it.

What the server keeps. This is a separate record from the access log described above and is kept for a different purpose. It is the complete list — there is nothing held about a submission that is not named here.

• About the submission itself: when it arrived, its score, which of the three bands it fell into, whether it was emailed, whether it was later escalated, and the date on which it is due to be deleted.
• Every signal that fired, with its weight and a short technical detail — a domain, a number, a duration, a language tag, or the automation flags your browser reported. Never a phrase from your message.
• About your network address: the address with the host part removed — the last block for IPv4, everything after the first three groups for IPv6 — and, looked up in a database held on this server, the network operator it belongs to, whether that operator is a datacentre rather than a consumer network, and the country. The full address is used to make those three lookups and is not stored.
• About your email address: the domain only, never the part before the @; whether that domain is a free-mail provider, a disposable-address service or a corporate one; and whether it accepts mail. Outside a held submission, which keeps your whole address (below), the part before the @ is used in two ways, and neither stores it: one scoring check compares it with the name you gave and records only that the two match, when they do; and for a free-mail address it goes into the rate-limiting fingerprint, below.
• About your browser: its family as one of about seven words, such as Firefox or Safari, and never its full identification string; the main language it asks for; your timezone and your local hour; how long the form had been open before you sent it; whether the request carried this site as its origin and whether it carried a referring page; and whether the signed ticket was present, valid or absent.
• About your message: its length in characters, and a one-way keyed fingerprint of it. The fingerprint lets the server notice the same text arriving repeatedly from unrelated senders. It cannot be turned back into the message. Your name, your address and your message themselves are not part of that record unless the submission scores highly enough to be held for a person to look at, in which case your name, address, organization, document type, deadline and message are kept with it until it is reviewed.
• For rate limiting, a keyed fingerprint of each of three things a submission arrived with: the shortened network address, the email domain, and the session identifier this server issued to your browser tab, with the time it arrived and the random reference of the post that made them, so that deleting one enquiry removes exactly its own fingerprints. For a free-mail address, such as Gmail, the second fingerprint is taken of your whole address rather than its domain — with any +tag removed, and for Gmail its dots — because keying Gmail by domain would let one sender use up the limit for every Gmail user. The same fingerprints are written for a submission the server refuses as invalid, such as one with a malformed email address, and last the same thirty days; none are written for one it refuses because a limit has been reached. They are fingerprints, not the values: none of the three is stored, and the server uses them only to count how many recent submissions match. But the key that makes them sits on the server, so they are not anonymous. Given an email address, the server can tell whether a fingerprint was made from it, which is how a deletion request finds them; and whoever holds the key could work out which network a network fingerprint came from by trying every network in turn. A session fingerprint cannot practically be traced back to its identifier.
• For replay protection, the serial number of the signed ticket a submission used, with the moment it expires, so that the same ticket cannot be spent twice.

Your screen size, the full user-agent string, the full network address and the text of an ordinary message are not kept anywhere on this server, apart from the page counter’s two short-lived exceptions stated under Page counts.

After the email is sent it is handled like any other business email: used to answer you, and to run the engagement if one follows. It is shared only with the people working on your enquiry or engagement — including any specialist brought in for it, under confidentiality — and is never sold or used for marketing.

Retention. The record above is deleted after thirty days, or ninety days where a submission was flagged for a second look; the rate-limiting fingerprints and the message fingerprint are deleted after thirty days regardless of how the submission scored, and a ticket serial number is deleted as soon as that ticket expires, a couple of hours after the page was loaded. A submission held for review is deleted within thirty days whether or not anyone has looked at it, and its content is deleted the moment it is released. The one exception is escalation: if a submission is escalated — a deliberate act by a person, because it turned out to matter for a complaint or an abuse report — then its record and its content, including your name, your email address and your message, are kept for up to twelve months and then deleted. Undoing an escalation moves the deletion date back to the shortest one above, counted from when the submission arrived, which is never later than it was before. Nothing else lengthens a deletion date. Once a submission has been turned into an email it also lives in SecHB’s enquiries mailbox, and is deleted when the enquiry is closed and no engagement followed; the copy in our mail server’s outgoing archive is deleted automatically ninety days after it was sent. Anyone it is shared with is bound to the same confidentiality and deletion terms. If an enquiry becomes a lead in our internal lead log, the log keeps the organization name, the contact name, an email address if we have one, the enquiry reference, our notes, the quotes we sent, and the lead’s status and dates. A lead marked lost or closed, with no accepted quote, is deleted with all its quotes automatically ninety days after it is marked lost or closed. Moving it between lost and closed does not restart that count; reopening it stops it. A lead that is still open, marked won, or has an accepted quote is kept as a business record until we delete it. The server’s own log, described above, has no fixed period. Every period in this section is the time after which something is deleted from our live systems.

Asking what is held, and having it deleted. Ask, and you will be told what is held about you, and it will be deleted from our live systems — with these limits, stated so that the answer you get is the true one:

• Deletion on the server removes the submission’s record, any held content and the fingerprints it left. A submission refused as invalid leaves no record, but the fingerprint made from your email address leads to it, and all of the fingerprints it left are removed; one whose email address had no domain cannot be found that way, and its fingerprints are deleted on their own date, thirty days after it arrived. At the moment of deletion the database overwrites the space the deleted entries occupied, rather than leaving it for the next daily clean-up.
• The emailed copy of an enquiry, and any daily reminder that quoted it, are in the enquiries mailbox and, for up to ninety days, in our mail server’s outgoing archive. Both are deleted by hand as part of the same request.
• A lead in our internal lead log, and every quote on it, is erased as soon as you ask, without waiting for the deletion date above.
• For an ordinary enquiry the server keeps no email address, so a request is matched as far as the record allows. A held enquiry is found by your address, whatever its letter case or +tag, and for Gmail whatever its dots. For a work or company address, the technical records are found by its domain, which can also reach a colleague’s records from the same domain; those are deleted too, which costs them nothing but a tuning record. For a free-mail address such as Gmail, a technical record can be tied to your address only while the rate-limiting fingerprint above exists, which is thirty days. A flagged enquiry older than that can no longer be found from your address: it names only your mail provider’s domain, and it is deleted on its own date, ninety days after it arrived, or twelve months if it was escalated.
• The server’s own log, which holds none of your name, email address, message or network address, is not reached by a deletion request.

Your rights, and how to complain

You can ask what we hold about you, ask for it to be corrected, and ask for it to be deleted where we are not required to keep it. Use the form on the contact page. If you are in the European Union or the United Kingdom you also have the rights to object, to restrict processing, and to receive your data in a portable form.

If you are not satisfied with how we handle a request, you are not limited to complaining to us:

• In British Columbia — the Office of the Information and Privacy Commissioner for BC, oipc.bc.ca.
• Elsewhere in Canada — the Office of the Privacy Commissioner of Canada, priv.gc.ca.
• In the European Union or the United Kingdom — your national supervisory authority.

Changes to this page

Material changes are published here with a new effective date. There is no mailing list to notify, by design.