Website security
Security & Data Handling
What this website does technically, what it collects, and what it deliberately does not do.
Scope of this page
This page describes takedownbureau.com — the public website, and nothing else. Each statement below describes how this site is built and served, and the statements about its code and its response headers are checked automatically before the site is published.
It does not describe how a copyright matter is handled after you contact us. Case correspondence, ownership evidence and authorization records are not processed by this website and are not stored on it. Where those records live is deliberately outside what a public marketing site should claim, and no claim about them is made here.
Website architecture
The strongest security property of this site is how little it does.
- Static build
- The site is rendered to plain HTML, CSS and font files ahead of time. There is no application server, no database and no server-side code running when you visit a page.
- No accounts
- There is no login, no registration and no user session on this website. Nothing on this domain asks you to create or hold credentials.
- No forms
- This website contains no web form of any kind. Its content security policy blocks form submission outright, so no page here can post data anywhere.
- No file upload
- There is no upload control on this website. Do not attempt to send evidence through it.
Transport security
- HTTPS enforced
- Plain HTTP requests are redirected to the HTTPS origin, and requests to the www host are redirected to the apex domain.
- Strict transport security
- The site sends an HSTS header with a one-year duration covering subdomains, so a conforming browser refuses to load it over plain HTTP after the first visit.
- Framing and type handling
- Framing is restricted to this origin, content-type sniffing is disabled, and referrer information is limited to the origin on cross-site navigation.
- Device permissions
- Geolocation, microphone and camera are disabled for this site by policy header. This website has no reason to request any of them.
Content security policy
The site is served under a restrictive content security policy with no inline-execution escape. This is the whole policy, in the order it is sent — all ten directives:
- default-src 'self'
- The fallback policy: resources default to this origin wherever no more specific directive below applies. Some directives that follow set a different rule for their own resource type or capability rather than a narrower one.
- script-src 'self'
- No inline script, no evaluated string, no third-party script. Executable code must be a same-origin file.
- style-src 'self'
- Styling must come from same-origin stylesheets. Inline style blocks and inline style attributes are refused, and the build ships none.
- font-src 'self'
- Typefaces are served from this origin only. No font CDN is contacted.
- img-src 'self' data:
- Images come from this origin, or are embedded in the page itself. No image is fetched from another host — so no third party learns you loaded a page here.
- connect-src 'self'
- The page cannot open a network connection to another host.
- object-src 'none'
- Plugin and embedded-object content is refused.
- base-uri 'self'
- The document base URL cannot be rewritten to another origin.
- form-action 'none'
- No form submission is permitted from any page on this site.
- frame-ancestors 'self'
- No other site may embed these pages in a frame.
A build that produced an inline script, an inline style block or an inline style attribute would fail our release checks rather than ship with a relaxed policy.
Third-party resources
There are none at runtime. Typefaces are self-hosted from this origin. No script, stylesheet, font, image or connection is fetched from another host when you load a page here.
Pages carry only a few kilobytes of same-origin vanilla JavaScript, for small enhancements: closing the mobile menu with Escape or an outside click, the shadow under the header once a page scrolls, the on-page contents rail, and the copy buttons beside published email addresses. No client framework is loaded. With JavaScript disabled, every page still renders in full, the menu still opens, and every link still works.
What this website collects
This public website does not operate advertising trackers, analytics trackers, user accounts, web forms or application-level visitor profiling.
- This website sets no cookies.
- It uses no browser storage — no local storage, no session storage, no client-side database.
- It runs no analytics, no tag manager, no advertising tag and no tracking pixel.
- It embeds no social widget, no comment system, no chat widget and no map.
- It loads no resource from any other host, so no third party observes your visit through this site.
Like any website, the hosting infrastructure that serves these pages can record standard technical request data — for example the requesting IP address, the page requested, the time of the request and the browser’s user-agent string — to operate and protect the service. That logging happens in the hosting infrastructure, outside this website’s code.
Email correspondence
Every matter begins by email, because this site accepts no data itself. Original copyright removal requests are submitted only from our filing mailbox, on this domain.
Email is not an encrypted channel end to end. Send what a matter requires and no more; if something is sensitive, say so and ask before sending it.
Reporting a security concern
If you believe you have found a vulnerability in this website, or a message that impersonates us, write to compliance@takedownbureau.com.
Please include what you observed and how to reproduce it. We ask that you do not run automated scanning that degrades the site for others, and that you do not access, alter or retain anyone else’s data while investigating.
We do not operate a paid vulnerability reward programme and make no commitment to one here.