Trust centre
Trust is not declared. Here are our commitments, what we do not promise, and how this site protects you.
Our six commitments
Security by design
Architecture, identity, least privilege, encryption and logging are considered from scoping onward.
Privacy and data
Collection limited to what is needed, governed access, residency requirements defined with the client.
Responsible AI
Each use case is assessed for value, data, risk, human oversight and traceability.
Operational resilience
Continuity, backup, recovery, observability and incident response fitted to how critical the service is.
Verifiable governance
Decisions, responsibilities, risks, changes and acceptance criteria are documented throughout the engagement.
Accessibility
Experiences that are readable, keyboard-navigable and usable on the devices that matter.
What we do not promise
We do not present a certification, data residency or guarantee as universal when it depends on the solution, the provider or the contract. For each engagement, scope, obligations and expected evidence are confirmed in writing.
The scenarios published on this site are illustrative. Named testimonials are only published with the client’s written permission.
How this site protects you
- Encrypted connections only (HTTPS with HSTS) and strict security headers, including a content security policy with no third-party script except the form’s bot check.
- No advertising cookies or trackers, and no fonts or libraries loaded from third parties.
- The contact form is protected by Cloudflare Turnstile, rate limiting and server-side validation. Your message is forwarded to Cafona by e-mail and is not stored by the site.
- Hosted on the Cloudflare network, published from a controlled code repository and tested automatically before every release.
Report a vulnerability
If you believe you have found a security issue affecting Cafona, this site or CafonApp, write to us. Describe the issue and how to reproduce it, without accessing data that is not yours or disrupting the service. We will acknowledge your report and keep you informed.
Machine-readable contact: /.well-known/security.txt
A security or compliance question?
Tell us your requirements: we will confirm what applies to your engagement, with evidence.