Company
How this site is built
A security adviser should be able to show how their own site is put together. Here is how this one works, how it got here, and why.
Why we show you
We advise clients to gather only what they need, hold it briefly and know where their data goes. This page explains the choices behind our own website, including why we collect so little, so you can judge whether we follow our own advice. If we could not run our own site with fewer moving parts, we would be badly placed to tell you to. The cookie notice covers what the site stores and how to check it.
Where it started
Until October 2026 this site ran on WordPress, with a theme and several plugins, on a shared hosting provider. It worked, but every plugin was one more thing to patch, and pages pulled fonts and scripts from other companies’ servers. We rebuilt it as plain, static pages, with one small exception described below.
How it changed
- 22 October 2026. We first tested the new version away from the public site. We served fonts and code libraries from our own hosting and set the build to refuse to finish if any page loaded anything from another site.
- 23 October 2026. The static site went live on cybercqr.co.uk, and paper downloads began to need a code emailed to a work address.
- 24 and 25 October 2026. We deleted the WordPress sites and chose Microsoft Azure for hosting, in the UK only. Visitors to cybercqr.com began to receive pages from it.
- 6 and 7 November 2026. The older cybercqr.co.uk domain moved to Namecheap, alongside our main domain, and now redirects to it. One address means one place to secure.
The decisions, and the reasons
- Static pages. There is no content management system or database to attack, so there is little to patch and fewer places for an attacker to look. The one piece of server code, the paper download gate, is limited to its own folder, and the server refuses to run code anywhere else.
- Nothing stored, nothing borrowed. No cookies, no browser storage, no analytics, and no fonts, scripts or widgets from other companies. That is why there is no cookie banner.
- Data stays in the UK. Azure delivers the site from UK data centres. We rejected one hosting option because it delivered pages from outside the UK.
- Scheduling through Microsoft. The “Book a conversation” button opens our Microsoft Bookings page, so the site needs no form or calendar tool of its own.
- Publishing without stored passwords. We publish changes from a private code repository on GitHub, and the connection to Azure uses short-lived sign-in instead of a password kept in a file.
- Strict browser protections. Every page tells the browser to run scripts only from this site, and we sign our domain names digitally (DNSSEC) so visitors reach the right server.
Why we value your security more than your data
Many websites measure every visit, as the data is useful to them. We chose not to: your privacy matters more to us than knowing which pages you read or how you found us. It is the same ethic we bring to client work: collect only what a job needs, and be open about what that is. We learn from conversations with readers and from search engine reports, and neither needs anything on your device. If we ever add website analytics, the cookie notice says how, and we will give you an opt-out before it starts.
Check it yourself
The cookie notice shows how to confirm each claim above with your browser’s developer tools in a few minutes.
Last updated 13/11/2026
Want the same thinking applied to your firm?
Start with a conversation about what you run, what you pay for, and what your board needs to see.
Contact us