1. Security principles
Qila's public website is deliberately designed to collect very little information. It does not provide file uploads, client portals or case-document storage. The initial enquiry process is designed so that privileged or client-identifying material is not required.
2. Website controls
- HTTPS is required for the live site.
- Form submissions are validated on the server and include a hidden honeypot intended to reduce automated spam.
- Form fields have length limits and the mail handler normalises input before placing it into email headers or messages.
- The website code does not write enquiry submissions to an application database.
- The site does not use Google Analytics, advertising pixels or conversion tracking in this build.
- Security headers are supplied in the deployment package to restrict framing, content types, browser permissions and executable script sources.
3. Confidential enquiries
Website enquiries are suitable for arranging a discussion and describing the general area of concern. They are not suitable for client files, evidence, privileged material, passwords, access tokens or other confidential documents.
If documents become necessary after an initial conversation, Qila will agree an appropriate secure transfer or collaboration method before material is shared.
4. Hosting and email
The site is intended to be hosted using one.com infrastructure and domain email. The live deployment should use HTTPS at all times, access to hosting and mail administration should be protected with strong credentials and multi-factor authentication where available, and administrative access should be limited to those who need it.
5. Reporting a security concern
If you identify a potential security issue affecting qilacompliance.ie, please report it privately to hassan@qilacompliance.ie. Please do not include exploit data or confidential third-party information unless requested through an agreed channel.
A machine-readable security contact is also published at /.well-known/security.txt.
6. No absolute security guarantee
No internet-facing service can guarantee absolute security. The controls described here are intended to reduce risk and support a proportionate security posture; they are not a certification or warranty that the website or any connected service is immune from attack.