Trust & engineering
How we run production: the uptime objective we publish, the security posture this very page ships with, the accessibility standard we build to, and the open data we expose. Buyers can verify every line of it from a browser.
01Availability
Every platform we operate is checked from this site every five minutes. Daily rollups are kept for 90 days and published as JSON, so an acquisition team can pull them into their own tooling rather than take our word for it. A platform is only shown as degraded after two consecutive failed checks.
≥ 99.9% 99–99.9% < 99% no data yet · 90 days, UTC · /api/uptime.json
02Security posture
The corporate site is built to the same standard we hold client systems to. Open your browser's network panel on this page and you will see the headers below on every response; nothing here is a marketing claim about some other system.
Content-Security-PolicyStrict allow-list: scripts and styles only from this origin, frames only from the scheduling provider, no inline event handlers, upgrade-insecure-requests.
Strict-Transport-SecurityHTTPS enforced for one year including subdomains (HSTS).
X-Frame-Options / frame-ancestorsThis site cannot be embedded in another site (clickjacking protection).
X-Content-Type-Optionsnosniff — browsers honor declared content types.
Referrer-Policystrict-origin-when-cross-origin — no path leakage to third parties.
Permissions-PolicyCamera, microphone and geolocation disabled; payment limited to the scheduler.
Verify: curl -sI https://cryptoliveleak.com/
We build to WCAG 2.2 AA and Section 508. This site: semantic landmarks, keyboard-operable navigation and dialogs, visible focus, 4.5:1 contrast in both themes, motion reduced on request, no information conveyed by color alone. Accessibility budgets run in CI on client work; a VPAT/ACR can be produced per deliverable.
First-party only. The contact form stores what you type and nothing else; conversion counts are cookie-free aggregates. No analytics vendor, no ad pixels, no fingerprinting. Data lives in U.S. infrastructure; deletion requests are honored within ten business days. See privacy.
Monitoring with a five-minute check interval, two-failure confirmation before public state changes, written runbooks, and post-incident reviews for anything customer-visible. Sustainment engagements inherit this playbook with named escalation contacts and response-time commitments in the SOW.
03Compliance posture
Frameworks buyers ask about and our honest status against each. "Practiced" means it is part of how we deliver today; "Aligned" means controls are mapped; "In progress" and "Roadmap" mean exactly that. We would rather be precise than impressive.
04Open data
Read-only, unauthenticated, CORS-open JSON. Pull our product registry into a vendor database, chart our uptime next to your other suppliers, or ingest the capability statement as structured data instead of a PDF. Described in OpenAPI 3.1.
/api/capability.jsonCapability statement as structured data — identifiers, NAICS, competencies, past performance, POC.
GET/api/status.jsonCurrent state, latency and 24h / 30d / 90d uptime per platform, plus the published SLO.
GET/api/uptime.jsonDaily uptime rollups for 90 days with check counts and latency.
GET/api/products.jsonProduct registry: every platform we operate with live metrics.
GET/api/health.jsonHealth of this corporate site: database, poller freshness, versions. Returns 503 when degraded.
GET/api/openapi.jsonOpenAPI 3.1 description of all of the above.
GET/capability-statement.pdfThe PDF, generated from the same data on request.
curl -s https://cryptoliveleak.com/api/status.json | jq '.services[] | {host, state, uptime_30d}'We instrument what we build the same way — public or private status, SLOs in the SOW, and runbooks your team can actually use.